185.180.141.32

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742069707020726561647920706f72743d3633310d0a",
    "emulator_response_len": 33,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Zenlayer Inc",
    "service": "ipp",
    "app_proto": "ipp",
    "asn": 21859,
    "country": "PT",
    "dst_port": 631,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "d290034684469cf8ada0be019adaec1e289feafe",
    "event_fingerprint": "7472879dd75c9aa24f48395a8ec989bd11e73b4b",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 48,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "ipp",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 631,
        "service": "ipp",
        "service_name": "ipp",
        "risk_score": 48
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "faf2ab054eaf67f0a2f256464b092b148cb704c1",
    "protocol_details": {
        "payload_preview": "SSH-2.0-Go",
        "port": 631,
        "service": "ipp",
        "service_label_fr": "IPP"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "Sonde SSH \u00b7 via IPP:631 \u00b7 (sonde \/ probe)",
    "target_port_label": "631 \u00b7 IPP",
    "emulator_service": "ipp",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 48,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ipp",
        "service_label_fr": "IPP",
        "dst_port": 631,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-ipp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "SSH-2.0-Go",
            "port": 631,
            "service": "ipp",
            "service_label_fr": "IPP"
        },
        "attack_vector": "Sonde SSH \u00b7 via IPP:631 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "631 \u00b7 IPP",
        "emulator_service": "ipp",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ipp",
        "service_banner": "honeypot-ipp",
        "service_os": "linux",
        "dst_port": "631"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742069707020726561647920706f72743d3633310d0a",
    "emulator_response_len": 33,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Zenlayer Inc",
    "service": "ipp",
    "app_proto": "ipp",
    "asn": 21859,
    "country": "PT",
    "dst_port": 631,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "d71f3907be7ed0f46f8494fbd62bda27aff2fd9e",
    "event_fingerprint": "0ff2363c0156fd28c9def3540d5e442f36179298",
    "classification_reason": "Type \u00ab ipp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "ipp",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "705e09bea990ea8643df74d79aabe770"
    },
    "target_context": {
        "dst_port": 631,
        "service": "ipp",
        "service_name": "ipp",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "befe6ed60c0374f3a612d277f1b24d12a7ac10d7",
    "protocol_details": {
        "port": 631,
        "service": "ipp",
        "service_label_fr": "IPP"
    },
    "attack_vector": "ipp \u00b7 via IPP:631 \u00b7 (sonde \/ probe)",
    "target_port_label": "631 \u00b7 IPP",
    "emulator_service": "ipp",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab ipp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab ipp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "ipp",
        "service_label_fr": "IPP",
        "dst_port": 631,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-ipp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 631,
            "service": "ipp",
            "service_label_fr": "IPP"
        },
        "attack_vector": "ipp \u00b7 via IPP:631 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "631 \u00b7 IPP",
        "emulator_service": "ipp",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ipp",
        "service_banner": "honeypot-ipp",
        "service_os": "linux",
        "dst_port": "631"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742069707020726561647920706f72743d3633310d0a",
    "emulator_response_len": 33,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Zenlayer Inc",
    "service": "ipp",
    "app_proto": "ipp",
    "asn": 21859,
    "country": "PT",
    "dst_port": 631,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "d71f3907be7ed0f46f8494fbd62bda27aff2fd9e",
    "event_fingerprint": "0ff2363c0156fd28c9def3540d5e442f36179298",
    "classification_reason": "Type \u00ab ipp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "ipp",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "705e09bea990ea8643df74d79aabe770"
    },
    "target_context": {
        "dst_port": 631,
        "service": "ipp",
        "service_name": "ipp",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "befe6ed60c0374f3a612d277f1b24d12a7ac10d7",
    "protocol_details": {
        "port": 631,
        "service": "ipp",
        "service_label_fr": "IPP"
    },
    "attack_vector": "ipp \u00b7 via IPP:631 \u00b7 (sonde \/ probe)",
    "target_port_label": "631 \u00b7 IPP",
    "emulator_service": "ipp",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab ipp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab ipp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "ipp",
        "service_label_fr": "IPP",
        "dst_port": 631,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-ipp",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 631,
            "service": "ipp",
            "service_label_fr": "IPP"
        },
        "attack_vector": "ipp \u00b7 via IPP:631 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "631 \u00b7 IPP",
        "emulator_service": "ipp",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ipp",
        "service_banner": "honeypot-ipp",
        "service_os": "linux",
        "dst_port": "631"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
    "http_host_hash": "9eb77341d923bf850a12632119cec98177710a79",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 252,
    "payload_entropy": 4.9992222833402264,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "http",
    "app_proto": "http",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9002,
    "risk_waf": 32,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 32,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "a59efe8fa6360423a807fa344dfbd7e5fc07fc22",
    "event_fingerprint": "5cad203ad3cc5da5ec66f72178af58d6cf6c50a0",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 106,
    "precision_signals": [
        "pat-0596",
        "pat-0439"
    ],
    "kb_rule_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_patterns": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_pattern_names": [
        "Sigma httpx tool",
        "UA httpx"
    ],
    "pattern_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 48,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "vuln_scanner",
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
        "payload_hash": "76cff70ba387bea13630a91e5254ca5d",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 9002,
        "service": "http",
        "service_name": "http",
        "risk_score": 48
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "python-httpx\/0.28.1",
    "waf_tags": [
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "python-httpx\/0.28.1",
        "waf_tags": [
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ae77fe1b052cece910397945924013d7061d46ec",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "python-httpx\/0.28.1",
        "port": 9002,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
    "attack_vector": "scanner vuln \u00b7 via HTTP:9002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
    "target_port_label": "9002 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 48,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9002,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0596",
            "pat-0439"
        ],
        "tags_summary_labels_fr": [
            "pat-0596",
            "pat-0439"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "python-httpx\/0.28.1",
            "port": 9002,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "scanner vuln \u00b7 via HTTP:9002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
        "target_port_label": "9002 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9002"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "minio-console"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
    "http_host_hash": "9eb77341d923bf850a12632119cec98177710a79",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 274,
    "payload_entropy": 5.029313196323024,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "http",
    "app_proto": "http",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9002,
    "risk_waf": 32,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 32,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "a59efe8fa6360423a807fa344dfbd7e5fc07fc22",
    "event_fingerprint": "1fe618bb769c02427f8c15b414691d55b25d144e",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 106,
    "precision_signals": [
        "pat-0596",
        "pat-0439"
    ],
    "kb_rule_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_patterns": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_pattern_names": [
        "Sigma httpx tool",
        "UA httpx"
    ],
    "pattern_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 48,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "vuln_scanner",
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
        "payload_hash": "dd7f74bad485ae2d8ac37fee038e2dd4",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 9002,
        "service": "http",
        "service_name": "http",
        "risk_score": 48
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "python-httpx\/0.28.1",
    "waf_tags": [
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "python-httpx\/0.28.1",
        "waf_tags": [
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e6e85c5495feb27e19b9857de47b5b03912618ad",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "python-httpx\/0.28.1",
        "port": 9002,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
    "attack_vector": "scanner vuln \u00b7 via HTTP:9002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
    "target_port_label": "9002 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 48,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9002,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0596",
            "pat-0439"
        ],
        "tags_summary_labels_fr": [
            "pat-0596",
            "pat-0439"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "python-httpx\/0.28.1",
            "port": 9002,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "scanner vuln \u00b7 via HTTP:9002 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
        "target_port_label": "9002 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9002"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "minio-console"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "minio-console",
    "app_proto": "minio-console",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9002,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "ff2a7fa41323728a8483f1f783f09ae0b1ebada4",
    "event_fingerprint": "b6934a8f5faeb2f67f99a7dbc0ecf0db1c31e783",
    "classification_reason": "Type \u00ab minio-console \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "minio-console",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "d82c16c3b724060c5d17f3cefc97e9df"
    },
    "target_context": {
        "dst_port": 9002,
        "service": "minio-console",
        "service_name": "minio-console",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6a1b02d7be119a7b8dedb6f07542d62591b0daa8",
    "protocol_details": {
        "port": 9002,
        "service": "minio-console",
        "service_label_fr": "MINIO CONSOLE"
    },
    "attack_vector": "minio-console \u00b7 via MINIO CONSOLE:9002 \u00b7 (sonde \/ probe)",
    "target_port_label": "9002 \u00b7 MINIO CONSOLE",
    "emulator_service": "minio-console",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab minio-console \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab minio-console \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "minio-console",
        "service_label_fr": "MINIO CONSOLE",
        "dst_port": 9002,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-minio-console",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 9002,
            "service": "minio-console",
            "service_label_fr": "MINIO CONSOLE"
        },
        "attack_vector": "minio-console \u00b7 via MINIO CONSOLE:9002 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9002 \u00b7 MINIO CONSOLE",
        "emulator_service": "minio-console",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "minio_console",
        "service_banner": "honeypot-minio-console",
        "service_os": "linux",
        "dst_port": "9002"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
    "http_host_hash": "01451af38469460a53dc2ed2efeee2cc613c8f6e",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 253,
    "payload_entropy": 4.987675379879332,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "http",
    "app_proto": "http",
    "asn": 21859,
    "country": "PT",
    "dst_port": 11300,
    "risk_waf": 32,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "3df5beb4313b5c65faa6992e001356db599f7689",
    "event_fingerprint": "7b7f000094f989261d78ca3d07b6ab7a245c3d44",
    "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 106,
    "precision_signals": [
        "pat-0596",
        "pat-0439"
    ],
    "kb_rule_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_patterns": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_pattern_names": [
        "Sigma httpx tool",
        "UA httpx"
    ],
    "pattern_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 48,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "vuln_scanner",
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
        "payload_hash": "700c657a4fc40f16eeb935e20453987a",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 11300,
        "service": "http",
        "service_name": "http",
        "risk_score": 48
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "python-httpx\/0.28.1",
    "waf_tags": [
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "python-httpx\/0.28.1",
        "waf_tags": [
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "288f37d44893f3ae9eb7f5308ffc76a4150369dc",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "python-httpx\/0.28.1",
        "port": 11300,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
    "attack_vector": "scanner vuln \u00b7 via HTTP:11300 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
    "target_port_label": "11300 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 48,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11300,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0596",
            "pat-0439"
        ],
        "tags_summary_labels_fr": [
            "pat-0596",
            "pat-0439"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "python-httpx\/0.28.1",
            "port": 11300,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "scanner vuln \u00b7 via HTTP:11300 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
        "target_port_label": "11300 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11300"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:11300"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f",
    "http_host_hash": "01451af38469460a53dc2ed2efeee2cc613c8f6e",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 188,
    "payload_entropy": 5.300748691687511,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "http",
    "app_proto": "http",
    "asn": 21859,
    "country": "PT",
    "dst_port": 11300,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "3df5beb4313b5c65faa6992e001356db599f7689",
    "event_fingerprint": "6e095927f8fbd09dae68df6787a44fc8934a2165",
    "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%",
    "confidence": 0.58,
    "classification_confidence": 0.58,
    "precision_score": 94,
    "precision_signals": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "kb_rule_ids": [
        "INT-benign-favicon",
        "INT-single-port",
        "INT-benign-path-cap"
    ],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e",
        "payload_hash": "6e095050c31c39d175820a6642b22ce4",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 11300,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
    "waf_tags": [
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
        "waf_tags": [
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
        "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "044c592fbcde28dceb11c37242e4e37f14b272d5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
        "port": 11300,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:11300 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "11300 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11300,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-benign-favicon",
            "INT-single-port",
            "INT-benign-path-cap"
        ],
        "tags_summary_labels_fr": [
            "Requ\u00eate favicon.ico",
            "Single Port",
            "Chemin b\u00e9nin connu"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36",
            "port": 11300,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:11300 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6",
        "target_port_label": "11300 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11300"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:11300"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 9,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d274f19c345ec10bae4ba72e19bf3ff3de00f943",
    "http_host_hash": "01451af38469460a53dc2ed2efeee2cc613c8f6e",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 516,
    "payload_entropy": 5.117093838254672,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "http",
    "app_proto": "http",
    "asn": 21859,
    "country": "PT",
    "dst_port": 11300,
    "risk_waf": 60,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 60,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2483fad04ceb943d48bfd3ea6d7ae7ac35cee175",
    "event_fingerprint": "a045cdc3192730f6e1a9e4fe248ac7b76526933b",
    "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 106,
    "precision_signals": [
        "pat-0596",
        "pat-0439"
    ],
    "kb_rule_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_patterns": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_pattern_names": [
        "Sigma httpx tool",
        "UA httpx"
    ],
    "pattern_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "confidence_breakdown": {
        "waf": 60,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 48,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "vuln_scanner",
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ca9b2eafc1cd86346d14d7fab560d7bb",
        "payload_hash": "1f931298971108d62c25f316f1f2a923",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 11300,
        "service": "http",
        "service_name": "http",
        "risk_score": 48
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "python-httpx\/0.28.1",
    "waf_tags": [
        "950383:rce-14",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-14",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nCont",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "python-httpx\/0.28.1",
        "waf_tags": [
            "950383:rce-14",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-14",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nCont",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
        "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d2a0962914600be8efd317a0fd06aa06e5c21362",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "python-httpx\/0.28.1",
        "port": 11300,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
    "attack_vector": "scanner vuln \u00b7 via HTTP:11300 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
    "target_port_label": "11300 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 60,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 48,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11300,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0596",
            "pat-0439"
        ],
        "tags_summary_labels_fr": [
            "pat-0596",
            "pat-0439"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "python-httpx\/0.28.1",
            "port": 11300,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "scanner vuln \u00b7 via HTTP:11300 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, t",
        "target_port_label": "11300 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11300"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:11300"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950383:rce-14",
        "950470:nosqli-3",
        "http_jwt_body"
    ]
}

{
    "bytes_in": 7,
    "payload_entropy": 2.2359263506290326,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": null,
    "app_proto": null,
    "asn": 21859,
    "country": "PT",
    "dst_port": 11300,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "a973a01b168f210513c9cd14b36cb695b6fadc63",
    "event_fingerprint": "8c09af816ab0392650420d5dd89a77a7131dbcd2",
    "classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 164,
    "precision_signals": [
        "pat-0374",
        "pat-0533",
        "pat-0865"
    ],
    "kb_rule_ids": [
        "pat-0374",
        "pat-0533",
        "pat-0865"
    ],
    "matched_patterns": [
        "pat-0374",
        "pat-0533",
        "pat-0865"
    ],
    "matched_pattern_names": [
        "Memcached stats",
        "Memcached stats",
        "ET Memcached UDP"
    ],
    "pattern_ids": [
        "pat-0374",
        "pat-0533",
        "pat-0865"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "11e629574907d3a9ced402e26f4a98df",
        "path_pattern_hash": "549d36783f9e3c43618e715d78a40b3b"
    },
    "target_context": {
        "dst_port": 11300,
        "risk_score": 50
    },
    "payload_preview": "stats\r\n",
    "request_sample": "stats\r\n",
    "payload_snippet": "stats",
    "evidence": {
        "request_sample": "stats\r\n",
        "payload_snippet": "stats",
        "classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2751f6744d9e08e457b709dbdb55b420f12df87d",
    "protocol_details": {
        "payload_preview": "stats",
        "port": 11300
    },
    "evidence_snippet": "stats",
    "attack_vector": "memcached probe \u00b7 port 11300 \u00b7 (sonde \/ probe)",
    "target_port_label": "11300",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11300,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0374",
            "pat-0533",
            "pat-0865"
        ],
        "tags_summary_labels_fr": [
            "pat-0374",
            "pat-0533",
            "pat-0865"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "stats",
            "port": 11300
        },
        "attack_vector": "memcached probe \u00b7 port 11300 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "stats",
        "target_port_label": "11300",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11300"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": null,
    "app_proto": null,
    "asn": 21859,
    "country": "PT",
    "dst_port": 11300,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "a973a01b168f210513c9cd14b36cb695b6fadc63",
    "event_fingerprint": "8c09af816ab0392650420d5dd89a77a7131dbcd2",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 11300,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7dc363d36ece1259483e710f34a33ba0c5e66d1f",
    "protocol_details": {
        "port": 11300
    },
    "attack_vector": "Sonde port \u00b7 port 11300 \u00b7 (sonde \/ probe)",
    "target_port_label": "11300",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11300,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 11300
        },
        "attack_vector": "Sonde port \u00b7 port 11300 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "11300",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11300"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "524642203030332e3030380a",
    "emulator_response_len": 12,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "vnc",
    "app_proto": "vnc",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5900,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "85454e6c29c51aac1db940d56f57ff1075b15dc1",
    "event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
    "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 82,
    "precision_signals": [
        "INT-tcp-vnc-auth"
    ],
    "kb_rule_ids": [
        "INT-tcp-vnc-auth"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "vnc_bruteforce",
    "service_name": "vnc",
    "risk_confidence_factor": 69,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1"
    },
    "target_context": {
        "dst_port": 5900,
        "service": "vnc",
        "service_name": "vnc",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c3ade5dd4bf2b10d4442d8160e05322d98a8e986",
    "protocol_details": {
        "port": 5900,
        "service": "vnc",
        "service_label_fr": "VNC"
    },
    "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
    "target_port_label": "5900 \u00b7 VNC",
    "emulator_service": "vnc",
    "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "vnc",
        "service_label_fr": "VNC",
        "dst_port": 5900,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-tcp-vnc-auth"
        ],
        "tags_summary_labels_fr": [
            "Tcp Vnc Auth"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-vnc",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 5900,
            "service": "vnc",
            "service_label_fr": "VNC"
        },
        "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "5900 \u00b7 VNC",
        "emulator_service": "vnc",
        "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "vnc",
        "service_banner": "honeypot-vnc",
        "service_os": "linux",
        "dst_port": "5900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_vnc_probe",
        "vnc_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "524642203030332e3030380a",
    "emulator_response_len": 12,
    "bytes_in": 215,
    "payload_entropy": 5.7945772201021235,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "vnc",
    "app_proto": "vnc",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5900,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a278da5f968ed132a1611a6016a9f26d4a82171a",
    "event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
    "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 82,
    "precision_signals": [
        "INT-tcp-vnc-auth"
    ],
    "kb_rule_ids": [
        "INT-tcp-vnc-auth"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "vnc_bruteforce",
    "service_name": "vnc",
    "risk_confidence_factor": 69,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bf673377ad7d7f7ede48350e0e281ca2",
        "path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1",
        "ja3": "ea217b0edcd93778471552ba0b796f81",
        "ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "tls_version": "0x0303",
        "tls_cipher_count": 4,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "ea217b0edcd93778471552ba0b796f81",
    "tls_ja3": "771,4866-4867-4865-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2",
    "tls_ja4_hash": "20cfcea4d0b06a5e70878e2ac1bf55f4",
    "tls_ja4": "t13d0104_a77009cba1e2_1e298527d56b",
    "tls_version": "0x0303",
    "tls_cipher_count": 4,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 5900,
        "service": "vnc",
        "service_name": "vnc",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdduAt\ufffd+G\ufffd\ufffd2\n\fd\ufffd\ufffd\ufffd;L\ufffd\ufffd\u001e~\ufffd[{\ufffd5\ufffd\u001c~ e\ufffdj\u0006L\ufffd\ufffdW\ufffd j\ufffd\ufffd\u06b5\ufffd<\u001c\ufffd\ufffd^\ufffd\ufffd[\u0002\ufffd\t\u001eg9\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdduAt\ufffd+G\ufffd\ufffd2\n\fd\ufffd\ufffd\ufffd;L\ufffd\ufffd\u001e~\ufffd[{\ufffd5\ufffd\u001c~ e\ufffdj\u0006L\ufffd\ufffdW\ufffd j\ufffd\ufffd\u06b5\ufffd<\u001c\ufffd\ufffd^\ufffd\ufffd[\u0002\ufffd\t\u001eg9\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u001e\u0000\u001c\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdz\ufffd\ufffd\u0011:7F\ufffd\u0202\ufffd\u82d4\u0010\ufffdO\u041e\u0401z?\ufffdA\ufffda{\ufffd'",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdduAt\ufffd+G\ufffd\ufffd2\n\fd\ufffd\ufffd\ufffd;L\ufffd\ufffd\u001e~\ufffd[{\ufffd5\ufffd\u001c~ e\ufffdj\u0006L\ufffd\ufffdW\ufffd j\ufffd\ufffd\u06b5\ufffd<\u001c\ufffd\ufffd^\ufffd\ufffd[\u0002\ufffd\t\u001eg9\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "33c45810db233106d655d8bcfe36356cdd92ec80",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdduAt\ufffd+G\ufffd\ufffd2\n\fd\ufffd\ufffd\ufffd;L\ufffd\ufffd\u001e~\ufffd[{\ufffd5\ufffd\u001c~ e\ufffdj\u0006L\ufffd\ufffdW\ufffd j\ufffd\ufffd\u06b5\ufffd<\u001c\ufffd\ufffd^\ufffd\ufffd[\u0002\ufffd\t\u001eg9\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
        "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "port": 5900,
        "service": "vnc",
        "service_label_fr": "VNC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdduAt\ufffd+G\ufffd\ufffd2\nd\ufffd\ufffd\ufffd;L\ufffd\ufffd~\ufffd[{\ufffd5\ufffd~ e\ufffdjL\ufffd\ufffdW\ufffd j\ufffd\ufffd\u06b5\ufffd<\ufffd\ufffd^\ufffd\ufffd[\ufffd\tg9\ufffd\ufffd}\n\n#",
    "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
    "target_port_label": "5900 \u00b7 VNC",
    "emulator_service": "vnc",
    "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "vnc",
        "service_label_fr": "VNC",
        "dst_port": 5900,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-tcp-vnc-auth"
        ],
        "tags_summary_labels_fr": [
            "Tcp Vnc Auth"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-vnc",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdduAt\ufffd+G\ufffd\ufffd2\n\fd\ufffd\ufffd\ufffd;L\ufffd\ufffd\u001e~\ufffd[{\ufffd5\ufffd\u001c~ e\ufffdj\u0006L\ufffd\ufffdW\ufffd j\ufffd\ufffd\u06b5\ufffd<\u001c\ufffd\ufffd^\ufffd\ufffd[\u0002\ufffd\t\u001eg9\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
            "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
            "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
            "port": 5900,
            "service": "vnc",
            "service_label_fr": "VNC"
        },
        "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdduAt\ufffd+G\ufffd\ufffd2\nd\ufffd\ufffd\ufffd;L\ufffd\ufffd~\ufffd[{\ufffd5\ufffd~ e\ufffdjL\ufffd\ufffdW\ufffd j\ufffd\ufffd\u06b5\ufffd<\ufffd\ufffd^\ufffd\ufffd[\ufffd\tg9\ufffd\ufffd}\n\n#",
        "target_port_label": "5900 \u00b7 VNC",
        "emulator_service": "vnc",
        "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "vnc",
        "service_banner": "honeypot-vnc",
        "service_os": "linux",
        "dst_port": "5900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_vnc_probe",
        "tls_clienthello",
        "vnc_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "524642203030332e3030380a",
    "emulator_response_len": 12,
    "bytes_in": 166,
    "payload_entropy": 4.667079427746113,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "vnc",
    "app_proto": "vnc",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5900,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a278da5f968ed132a1611a6016a9f26d4a82171a",
    "event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
    "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 82,
    "precision_signals": [
        "INT-tcp-vnc-auth"
    ],
    "kb_rule_ids": [
        "INT-tcp-vnc-auth"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "vnc_bruteforce",
    "service_name": "vnc",
    "risk_confidence_factor": 69,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "83d073719f354cd589232b2ed722a4d5",
        "path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1",
        "ja3": "caaddd3ed0a315543d761490b01b08e0",
        "ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
        "tls_version": "0x0303",
        "tls_cipher_count": 13,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "caaddd3ed0a315543d761490b01b08e0",
    "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281-15-18,23-24-25,0",
    "tls_ja4_hash": "15b6611f90c03a9f6b2a99be9ffb1608",
    "tls_ja4": "t13d0113_5fb62fe3077b_40d2e578a3e2",
    "tls_version": "0x0303",
    "tls_cipher_count": 13,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 5900,
        "service": "vnc",
        "service_name": "vnc",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd]\ufffdN|eQNb\b\u03b1y\ufffd\u0005\u0013#\ufffd\ufffd\ufffd\u0713\u0007\ufffd\ufffd\u0017H\ufffd\ufffd[j^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd]\ufffdN|eQNb\b\u03b1y\ufffd\u0005\u0013#\ufffd\ufffd\ufffd\u0713\u0007\ufffd\ufffd\u0017H\ufffd\ufffd[j^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0001\u0001\u0001\u0003\u0001\u0002\ufffd\u0001\u0000\u0001\u0000\u0000\u000f\u0000\u0001\u0001\u0000\u0012\u0000\u0000\u0015\u0003\u0001\u0000\u0002\u0002\n",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd]\ufffdN|eQNb\b\u03b1y\ufffd\u0005\u0013#\ufffd\ufffd\ufffd\u0713\u0007\ufffd\ufffd\u0017H\ufffd\ufffd[j^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0521ee485420ea3f0eaf27c02722156bea6c81c5",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd]\ufffdN|eQNb\b\u03b1y\ufffd\u0005\u0013#\ufffd\ufffd\ufffd\u0713\u0007\ufffd\ufffd\u0017H\ufffd\ufffd[j^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
        "tls_ja3": "caaddd3ed0a315543d761490b01b08e0",
        "tls_ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
        "port": 5900,
        "service": "vnc",
        "service_label_fr": "VNC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd]\ufffdN|eQNb\u03b1y\ufffd#\ufffd\ufffd\ufffd\u0713\ufffd\ufffdH\ufffd\ufffd[j^\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\nS\n\r&$",
    "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
    "target_port_label": "5900 \u00b7 VNC",
    "emulator_service": "vnc",
    "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "vnc",
        "service_label_fr": "VNC",
        "dst_port": 5900,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-tcp-vnc-auth"
        ],
        "tags_summary_labels_fr": [
            "Tcp Vnc Auth"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-vnc",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd]\ufffdN|eQNb\b\u03b1y\ufffd\u0005\u0013#\ufffd\ufffd\ufffd\u0713\u0007\ufffd\ufffd\u0017H\ufffd\ufffd[j^\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
            "tls_ja3": "caaddd3ed0a315543d761490b01b08e0",
            "tls_ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
            "port": 5900,
            "service": "vnc",
            "service_label_fr": "VNC"
        },
        "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd]\ufffdN|eQNb\u03b1y\ufffd#\ufffd\ufffd\ufffd\u0713\ufffd\ufffdH\ufffd\ufffd[j^\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\nS\n\r&$",
        "target_port_label": "5900 \u00b7 VNC",
        "emulator_service": "vnc",
        "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "vnc",
        "service_banner": "honeypot-vnc",
        "service_os": "linux",
        "dst_port": "5900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_vnc_probe",
        "tls_clienthello",
        "vnc_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "524642203030332e3030380a",
    "emulator_response_len": 12,
    "bytes_in": 48,
    "payload_entropy": 4.240601562950723,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "vnc",
    "app_proto": "vnc",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5900,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "85454e6c29c51aac1db940d56f57ff1075b15dc1",
    "event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
    "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 82,
    "precision_signals": [
        "INT-tcp-vnc-auth"
    ],
    "kb_rule_ids": [
        "INT-tcp-vnc-auth"
    ],
    "matched_patterns": [
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "vnc_bruteforce",
    "service_name": "vnc",
    "risk_confidence_factor": 69,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "37e55f17042fc1eb3b12770556a60f8f",
        "path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1"
    },
    "target_context": {
        "dst_port": 5900,
        "service": "vnc",
        "service_name": "vnc",
        "risk_score": 42
    },
    "payload_preview": "\ufffd.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\ufffd\ufffdYg\ufffd0\ufffd\ufffdW\u0007\ufffd\ufffd\ufffd\u001f\ufffd\ufffd",
    "request_sample": "\ufffd.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\ufffd\ufffdYg\ufffd0\ufffd\ufffdW\u0007\ufffd\ufffd\ufffd\u001f\ufffd\ufffd",
    "payload_snippet": "\ufffd.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\ufffd\ufffdYg\ufffd0\ufffd\ufffdW\u0007\ufffd\ufffd\ufffd\u001f\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\ufffd\ufffdYg\ufffd0\ufffd\ufffdW\u0007\ufffd\ufffd\ufffd\u001f\ufffd\ufffd",
        "payload_snippet": "\ufffd.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\ufffd\ufffdYg\ufffd0\ufffd\ufffdW\u0007\ufffd\ufffd\ufffd\u001f\ufffd\ufffd",
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dfeafeade5cff66aa7f2f523b047bf69236a6cb1",
    "protocol_details": {
        "payload_preview": "\ufffd.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\ufffd\ufffdYg\ufffd0\ufffd\ufffdW\u0007\ufffd\ufffd\ufffd\u001f\ufffd\ufffd",
        "port": 5900,
        "service": "vnc",
        "service_label_fr": "VNC"
    },
    "evidence_snippet": "\ufffd.\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffdYg\ufffd0\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd",
    "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
    "target_port_label": "5900 \u00b7 VNC",
    "emulator_service": "vnc",
    "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "vnc",
        "service_label_fr": "VNC",
        "dst_port": 5900,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-tcp-vnc-auth"
        ],
        "tags_summary_labels_fr": [
            "Tcp Vnc Auth"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-vnc",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\ufffd.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000\ufffd\u0003\u0000\ufffd\u0001\u0000\ufffd\u0007\u0000\ufffd\u0006\u0000@\u0004\u0000\ufffd\u0002\u0000\ufffd\ufffd\ufffdYg\ufffd0\ufffd\ufffdW\u0007\ufffd\ufffd\ufffd\u001f\ufffd\ufffd",
            "port": 5900,
            "service": "vnc",
            "service_label_fr": "VNC"
        },
        "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd.\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffdYg\ufffd0\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd",
        "target_port_label": "5900 \u00b7 VNC",
        "emulator_service": "vnc",
        "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "vnc",
        "service_banner": "honeypot-vnc",
        "service_os": "linux",
        "dst_port": "5900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_vnc_probe",
        "vnc_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "524642203030332e3030380a",
    "emulator_response_len": 12,
    "bytes_in": 1476,
    "payload_entropy": 7.772966105129846,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "vnc",
    "app_proto": "vnc",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5900,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a278da5f968ed132a1611a6016a9f26d4a82171a",
    "event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
    "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 82,
    "precision_signals": [
        "INT-tcp-vnc-auth"
    ],
    "kb_rule_ids": [
        "INT-tcp-vnc-auth"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "vnc_bruteforce",
    "service_name": "vnc",
    "risk_confidence_factor": 69,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8af7eaacc6c0351686a903dbfc3c6c40",
        "path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1"
    },
    "target_context": {
        "dst_port": 5900,
        "service": "vnc",
        "service_name": "vnc",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003TN\ufffdvH\ufffd!\ufffd\ufffd_\ufffdhu\ufffd3)\ufffd`#a\ufffd\ufffd\ufffd\ufffdG2\ufffd5ma\ufffd \ufffd\ufffd\u0000\ufffd\u0006\ufffd\ufffd\ufffd\ufffdHb\ufffdp\ufffd\ufffdG>\b\ufffdO?\u001c\ufffd\u0013\u0730\ufffd\u000fe\ufffd>\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003TN\ufffdvH\ufffd!\ufffd\ufffd_\ufffdhu\ufffd3)\ufffd`#a\ufffd\ufffd\ufffd\ufffdG2\ufffd5ma\ufffd \ufffd\ufffd\u0000\ufffd\u0006\ufffd\ufffd\ufffd\ufffdHb\ufffdp\ufffd\ufffdG>\b\ufffdO?\u001c\ufffd\u0013\u0730\ufffd\u000fe\ufffd>\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd,\ufffd*\ufffd\ufffdHH\ufffdB\ufffd%>~\ufffd|\ufffd\ufffd\ufffdV\ufffd\ufffdD5YR\ufffdS\ufffd\ufffd(C\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003TN\ufffdvH\ufffd!\ufffd\ufffd_\ufffdhu\ufffd3)\ufffd`#a\ufffd\ufffd\ufffd\ufffdG2\ufffd5ma\ufffd \ufffd\ufffd\u0000\ufffd\u0006\ufffd\ufffd\ufffd\ufffdHb\ufffdp\ufffd\ufffdG>\b\ufffdO?\u001c\ufffd\u0013\u0730\ufffd\u000fe\ufffd>\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "32df4d7ad53ae5816266b864e1a3f5d9cf5e5e4f",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003TN\ufffdvH\ufffd!\ufffd\ufffd_\ufffdhu\ufffd3)\ufffd`#a\ufffd\ufffd\ufffd\ufffdG2\ufffd5ma\ufffd \ufffd\ufffd\u0000\ufffd\u0006\ufffd\ufffd\ufffd\ufffdHb\ufffdp\ufffd\ufffdG>\b\ufffdO?\u001c\ufffd\u0013\u0730\ufffd\u000fe\ufffd>\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "port": 5900,
        "service": "vnc",
        "service_label_fr": "VNC"
    },
    "evidence_snippet": "\ufffd\ufffdTN\ufffdvH\ufffd!\ufffd\ufffd_\ufffdhu\ufffd3)\ufffd`#a\ufffd\ufffd\ufffd\ufffdG2\ufffd5ma\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdHb\ufffdp\ufffd\ufffdG>\ufffdO?\ufffd\u0730\ufffde\ufffd>&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL",
    "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
    "target_port_label": "5900 \u00b7 VNC",
    "emulator_service": "vnc",
    "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "vnc",
        "service_label_fr": "VNC",
        "dst_port": 5900,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-tcp-vnc-auth"
        ],
        "tags_summary_labels_fr": [
            "Tcp Vnc Auth"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-vnc",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003TN\ufffdvH\ufffd!\ufffd\ufffd_\ufffdhu\ufffd3)\ufffd`#a\ufffd\ufffd\ufffd\ufffdG2\ufffd5ma\ufffd \ufffd\ufffd\u0000\ufffd\u0006\ufffd\ufffd\ufffd\ufffdHb\ufffdp\ufffd\ufffdG>\b\ufffdO?\u001c\ufffd\u0013\u0730\ufffd\u000fe\ufffd>\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "port": 5900,
            "service": "vnc",
            "service_label_fr": "VNC"
        },
        "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdTN\ufffdvH\ufffd!\ufffd\ufffd_\ufffdhu\ufffd3)\ufffd`#a\ufffd\ufffd\ufffd\ufffdG2\ufffd5ma\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdHb\ufffdp\ufffd\ufffdG>\ufffdO?\ufffd\u0730\ufffde\ufffd>&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL",
        "target_port_label": "5900 \u00b7 VNC",
        "emulator_service": "vnc",
        "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "vnc",
        "service_banner": "honeypot-vnc",
        "service_os": "linux",
        "dst_port": "5900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_vnc_probe",
        "tls_clienthello",
        "vnc_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "524642203030332e3030380a",
    "emulator_response_len": 12,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "vnc",
    "app_proto": "vnc",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5900,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "85454e6c29c51aac1db940d56f57ff1075b15dc1",
    "event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
    "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 82,
    "precision_signals": [
        "INT-tcp-vnc-auth"
    ],
    "kb_rule_ids": [
        "INT-tcp-vnc-auth"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "vnc_bruteforce",
    "service_name": "vnc",
    "risk_confidence_factor": 69,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1"
    },
    "target_context": {
        "dst_port": 5900,
        "service": "vnc",
        "service_name": "vnc",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c3ade5dd4bf2b10d4442d8160e05322d98a8e986",
    "protocol_details": {
        "port": 5900,
        "service": "vnc",
        "service_label_fr": "VNC"
    },
    "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
    "target_port_label": "5900 \u00b7 VNC",
    "emulator_service": "vnc",
    "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "vnc",
        "service_label_fr": "VNC",
        "dst_port": 5900,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-tcp-vnc-auth"
        ],
        "tags_summary_labels_fr": [
            "Tcp Vnc Auth"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-vnc",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 5900,
            "service": "vnc",
            "service_label_fr": "VNC"
        },
        "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "5900 \u00b7 VNC",
        "emulator_service": "vnc",
        "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "vnc",
        "service_banner": "honeypot-vnc",
        "service_os": "linux",
        "dst_port": "5900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_vnc_probe",
        "vnc_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "524642203030332e3030380a",
    "emulator_response_len": 12,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "vnc",
    "app_proto": "vnc",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5900,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "85454e6c29c51aac1db940d56f57ff1075b15dc1",
    "event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
    "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 82,
    "precision_signals": [
        "INT-tcp-vnc-auth"
    ],
    "kb_rule_ids": [
        "INT-tcp-vnc-auth"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42
    },
    "named_classification_skipped": true,
    "named_candidate": "vnc_bruteforce",
    "service_name": "vnc",
    "risk_confidence_factor": 69,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1"
    },
    "target_context": {
        "dst_port": 5900,
        "service": "vnc",
        "service_name": "vnc",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c3ade5dd4bf2b10d4442d8160e05322d98a8e986",
    "protocol_details": {
        "port": 5900,
        "service": "vnc",
        "service_label_fr": "VNC"
    },
    "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
    "target_port_label": "5900 \u00b7 VNC",
    "emulator_service": "vnc",
    "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "vnc",
        "service_label_fr": "VNC",
        "dst_port": 5900,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-tcp-vnc-auth"
        ],
        "tags_summary_labels_fr": [
            "Tcp Vnc Auth"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-vnc",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 5900,
            "service": "vnc",
            "service_label_fr": "VNC"
        },
        "attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "5900 \u00b7 VNC",
        "emulator_service": "vnc",
        "confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "vnc",
        "service_banner": "honeypot-vnc",
        "service_os": "linux",
        "dst_port": "5900"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_vnc_probe",
        "vnc_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "cassandra-thrift",
    "app_proto": "cassandra-thrift",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9160,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1933dafc26d0f227d26434e5c7bc8006f9a569ea",
    "event_fingerprint": "01804df643364bdc1606f971ae4b28eac77e55dd",
    "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-thrift",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494"
    },
    "target_context": {
        "dst_port": 9160,
        "service": "cassandra-thrift",
        "service_name": "cassandra-thrift",
        "risk_score": 34
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fffd88aff02016ca9d9c8d5ef37877aadf2be1eb",
    "protocol_details": {
        "port": 9160,
        "service": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT"
    },
    "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
    "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
    "emulator_service": "cassandra-thrift",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT",
        "dst_port": 9160,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-thrift",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 9160,
            "service": "cassandra-thrift",
            "service_label_fr": "CASSANDRA THRIFT"
        },
        "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
        "emulator_service": "cassandra-thrift",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_thrift",
        "service_banner": "honeypot-cassandra-thrift",
        "service_os": "linux",
        "dst_port": "9160"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "bytes_in": 215,
    "payload_entropy": 5.8341609927151925,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "cassandra-thrift",
    "app_proto": "cassandra-thrift",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9160,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a849898c92a08d3cab5f32992358a435dce5183d",
    "event_fingerprint": "01804df643364bdc1606f971ae4b28eac77e55dd",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "cassandra-thrift",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1e0ecf8bac1c7751d878682a2a814ff7",
        "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494",
        "ja3": "ea217b0edcd93778471552ba0b796f81",
        "ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "tls_version": "0x0303",
        "tls_cipher_count": 4,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "ea217b0edcd93778471552ba0b796f81",
    "tls_ja3": "771,4866-4867-4865-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2",
    "tls_ja4_hash": "20cfcea4d0b06a5e70878e2ac1bf55f4",
    "tls_ja4": "t13d0104_a77009cba1e2_1e298527d56b",
    "tls_version": "0x0303",
    "tls_cipher_count": 4,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9160,
        "service": "cassandra-thrift",
        "service_name": "cassandra-thrift",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003nm\ufffd\ufffdw\ufffd\ufffdL\ufffd\ufffd#[\ufffdp\ufffdHAQ\ufffd\ufffd\b@\ufffd>\ufffd\ufffdsS\ufffd-\ufffd7 \ufffd\ufffd\ufffd\ufffd{i\ufffd\ufffd\ufffd\ufffd,[\ufffd!~PX6\u001a\ufffd7\ufffdS\ufffd\u0007M\ufffds\ufffd[\ufffd4\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003nm\ufffd\ufffdw\ufffd\ufffdL\ufffd\ufffd#[\ufffdp\ufffdHAQ\ufffd\ufffd\b@\ufffd>\ufffd\ufffdsS\ufffd-\ufffd7 \ufffd\ufffd\ufffd\ufffd{i\ufffd\ufffd\ufffd\ufffd,[\ufffd!~PX6\u001a\ufffd7\ufffdS\ufffd\u0007M\ufffds\ufffd[\ufffd4\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u001e\u0000\u001c\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u00121M\ufffd'\ufffdx\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffd\u029a\ufffd\ufffd\ufffd\u001e!\ufffd\ufffd\ufffd\u0006\ufffd`\u0007",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003nm\ufffd\ufffdw\ufffd\ufffdL\ufffd\ufffd#[\ufffdp\ufffdHAQ\ufffd\ufffd\b@\ufffd>\ufffd\ufffdsS\ufffd-\ufffd7 \ufffd\ufffd\ufffd\ufffd{i\ufffd\ufffd\ufffd\ufffd,[\ufffd!~PX6\u001a\ufffd7\ufffdS\ufffd\u0007M\ufffds\ufffd[\ufffd4\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a97bbe11c0b686864f124af3b7592b7e7f09e6ce",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003nm\ufffd\ufffdw\ufffd\ufffdL\ufffd\ufffd#[\ufffdp\ufffdHAQ\ufffd\ufffd\b@\ufffd>\ufffd\ufffdsS\ufffd-\ufffd7 \ufffd\ufffd\ufffd\ufffd{i\ufffd\ufffd\ufffd\ufffd,[\ufffd!~PX6\u001a\ufffd7\ufffdS\ufffd\u0007M\ufffds\ufffd[\ufffd4\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
        "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "port": 9160,
        "service": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT"
    },
    "evidence_snippet": "\ufffd\ufffdnm\ufffd\ufffdw\ufffd\ufffdL\ufffd\ufffd#[\ufffdp\ufffdHAQ\ufffd\ufffd@\ufffd>\ufffd\ufffdsS\ufffd-\ufffd7 \ufffd\ufffd\ufffd\ufffd{i\ufffd\ufffd\ufffd\ufffd,[\ufffd!~PX6\ufffd7\ufffdS\ufffdM\ufffds\ufffd[\ufffd4\ufffd}\n\n#",
    "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
    "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
    "emulator_service": "cassandra-thrift",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT",
        "dst_port": 9160,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-thrift",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003nm\ufffd\ufffdw\ufffd\ufffdL\ufffd\ufffd#[\ufffdp\ufffdHAQ\ufffd\ufffd\b@\ufffd>\ufffd\ufffdsS\ufffd-\ufffd7 \ufffd\ufffd\ufffd\ufffd{i\ufffd\ufffd\ufffd\ufffd,[\ufffd!~PX6\u001a\ufffd7\ufffdS\ufffd\u0007M\ufffds\ufffd[\ufffd4\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
            "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
            "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
            "port": 9160,
            "service": "cassandra-thrift",
            "service_label_fr": "CASSANDRA THRIFT"
        },
        "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdnm\ufffd\ufffdw\ufffd\ufffdL\ufffd\ufffd#[\ufffdp\ufffdHAQ\ufffd\ufffd@\ufffd>\ufffd\ufffdsS\ufffd-\ufffd7 \ufffd\ufffd\ufffd\ufffd{i\ufffd\ufffd\ufffd\ufffd,[\ufffd!~PX6\ufffd7\ufffdS\ufffdM\ufffds\ufffd[\ufffd4\ufffd}\n\n#",
        "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
        "emulator_service": "cassandra-thrift",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_thrift",
        "service_banner": "honeypot-cassandra-thrift",
        "service_os": "linux",
        "dst_port": "9160"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "bytes_in": 159,
    "payload_entropy": 4.70779636059955,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "cassandra-thrift",
    "app_proto": "cassandra-thrift",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9160,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a849898c92a08d3cab5f32992358a435dce5183d",
    "event_fingerprint": "01804df643364bdc1606f971ae4b28eac77e55dd",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-thrift",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "dff756552473c91ec12d73b9173300b9",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "caaddd3ed0a315543d761490b01b08e0",
        "ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
        "tls_version": "0x0303",
        "tls_cipher_count": 13,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "caaddd3ed0a315543d761490b01b08e0",
    "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281-15-18,23-24-25,0",
    "tls_ja4_hash": "15b6611f90c03a9f6b2a99be9ffb1608",
    "tls_ja4": "t13d0113_5fb62fe3077b_40d2e578a3e2",
    "tls_version": "0x0303",
    "tls_cipher_count": 13,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9160,
        "service": "cassandra-thrift",
        "service_name": "cassandra-thrift",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffdmvS\ufffd$'`\u0004\ufffd\ufffd\u001cmF.R\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\r\ufffd^o\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffdmvS\ufffd$'`\u0004\ufffd\ufffd\u001cmF.R\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\r\ufffd^o\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0001\u0001\u0001\u0003\u0001\u0002\ufffd\u0001\u0000\u0001\u0000\u0000\u000f\u0000\u0001\u0001\u0000\u0012\u0000\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffdmvS\ufffd$'`\u0004\ufffd\ufffd\u001cmF.R\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\r\ufffd^o\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "86855f8697df5e27ce3d71e54567276b39daf6dd",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffdmvS\ufffd$'`\u0004\ufffd\ufffd\u001cmF.R\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\r\ufffd^o\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
        "tls_ja3": "caaddd3ed0a315543d761490b01b08e0",
        "tls_ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
        "port": 9160,
        "service": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdmvS\ufffd$'`\ufffd\ufffdmF.R\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\r\ufffd^o\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\nS\n\r&$",
    "attack_vector": "postgres probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
    "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
    "emulator_service": "cassandra-thrift",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT",
        "dst_port": 9160,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-thrift",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001d\ufffdmvS\ufffd$'`\u0004\ufffd\ufffd\u001cmF.R\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\r\ufffd^o\ufffd\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
            "tls_ja3": "caaddd3ed0a315543d761490b01b08e0",
            "tls_ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
            "port": 9160,
            "service": "cassandra-thrift",
            "service_label_fr": "CASSANDRA THRIFT"
        },
        "attack_vector": "postgres probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdmvS\ufffd$'`\ufffd\ufffdmF.R\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\ufffd\r\ufffd^o\ufffd\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\nS\n\r&$",
        "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
        "emulator_service": "cassandra-thrift",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_thrift",
        "service_banner": "honeypot-cassandra-thrift",
        "service_os": "linux",
        "dst_port": "9160"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "cassandra-thrift",
    "app_proto": "cassandra-thrift",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9160,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1933dafc26d0f227d26434e5c7bc8006f9a569ea",
    "event_fingerprint": "01804df643364bdc1606f971ae4b28eac77e55dd",
    "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-thrift",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494"
    },
    "target_context": {
        "dst_port": 9160,
        "service": "cassandra-thrift",
        "service_name": "cassandra-thrift",
        "risk_score": 34
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fffd88aff02016ca9d9c8d5ef37877aadf2be1eb",
    "protocol_details": {
        "port": 9160,
        "service": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT"
    },
    "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
    "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
    "emulator_service": "cassandra-thrift",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT",
        "dst_port": 9160,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 9160,
            "service": "cassandra-thrift",
            "service_label_fr": "CASSANDRA THRIFT"
        },
        "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
        "emulator_service": "cassandra-thrift",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_thrift",
        "service_banner": "honeypot-cassandra-thrift",
        "service_os": "linux",
        "dst_port": "9160"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
    "emulator_response_len": 77,
    "bytes_in": 274,
    "payload_entropy": 5.038401608715992,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "winrm",
    "app_proto": "winrm",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5985,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "57c5332c05bc9744f2e25c304e6c03b568173b7b",
    "event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
    "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 106,
    "precision_signals": [
        "pat-0596",
        "pat-0439"
    ],
    "kb_rule_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_patterns": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_pattern_names": [
        "Sigma httpx tool",
        "UA httpx"
    ],
    "pattern_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "classification_parent": "vuln_scanner",
    "service_name": "winrm",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f7552642305e6bf69effdcc2504ad1c7",
        "path_pattern_hash": "b71c8aad2b015494f15e7bb035951b05"
    },
    "target_context": {
        "dst_port": 5985,
        "service": "winrm",
        "service_name": "winrm",
        "risk_score": 48
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
    "evidence": {
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\nConte",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
        "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "53b1ca423d6a49569532ba5f2e3cfaaf369339ae",
    "protocol_details": {
        "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
        "port": 5985,
        "service": "winrm",
        "service_label_fr": "WINRM"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
    "attack_vector": "scanner vuln \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
    "target_port_label": "5985 \u00b7 WINRM",
    "emulator_service": "winrm",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "winrm",
        "service_label_fr": "WINRM",
        "dst_port": 5985,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0596",
            "pat-0439"
        ],
        "tags_summary_labels_fr": [
            "pat-0596",
            "pat-0439"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-winrm",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
            "port": 5985,
            "service": "winrm",
            "service_label_fr": "WINRM"
        },
        "attack_vector": "scanner vuln \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, te",
        "target_port_label": "5985 \u00b7 WINRM",
        "emulator_service": "winrm",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "winrm",
        "service_banner": "honeypot-winrm",
        "service_os": "linux",
        "dst_port": "5985"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_winrm_probe",
        "winrm_emulated",
        "winrm_payload"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
    "emulator_response_len": 77,
    "bytes_in": 252,
    "payload_entropy": 5.007158791276734,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "winrm",
    "app_proto": "winrm",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5985,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 46,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 46,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "517cc1b4bef40760fee9c1649c6c0bb752cac87d",
    "event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
    "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 106,
    "precision_signals": [
        "pat-0596",
        "pat-0439"
    ],
    "kb_rule_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_patterns": [
        "pat-0596",
        "pat-0439"
    ],
    "matched_pattern_names": [
        "Sigma httpx tool",
        "UA httpx"
    ],
    "pattern_ids": [
        "pat-0596",
        "pat-0439"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 46,
        "novelty": 15,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "classification_parent": "vuln_scanner",
    "service_name": "winrm",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a22419f76a6f84475a0254e3e82915f0",
        "path_pattern_hash": "b71c8aad2b015494f15e7bb035951b05"
    },
    "target_context": {
        "dst_port": 5985,
        "service": "winrm",
        "service_name": "winrm",
        "risk_score": 48
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
    "evidence": {
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, text\/event-stream\r\naccept-Language: *\r\ncontent-type: application\/json\r\nsec-Fetch-Mode: cors\r\naccept-Encoding: gzip, deflate\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
        "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7b0367567fac2d18ed9e5137692575ffd828b11b",
    "protocol_details": {
        "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
        "port": 5985,
        "service": "winrm",
        "service_label_fr": "WINRM"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
    "attack_vector": "scanner vuln \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
    "target_port_label": "5985 \u00b7 WINRM",
    "emulator_service": "winrm",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab scanner_vuln \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 46,
            "novelty": 15,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "winrm",
        "service_label_fr": "WINRM",
        "dst_port": 5985,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0596",
            "pat-0439"
        ],
        "tags_summary_labels_fr": [
            "pat-0596",
            "pat-0439"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-winrm",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
            "port": 5985,
            "service": "winrm",
            "service_label_fr": "WINRM"
        },
        "attack_vector": "scanner vuln \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nConnection: keep-alive\r\nUser-Agent: python-httpx\/0.28.1\r\naccept: application\/json, tex",
        "target_port_label": "5985 \u00b7 WINRM",
        "emulator_service": "winrm",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "winrm",
        "service_banner": "honeypot-winrm",
        "service_os": "linux",
        "dst_port": "5985"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "net_winrm_probe",
        "winrm_emulated",
        "winrm_payload"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
    "emulator_response_len": 77,
    "bytes_in": 176,
    "payload_entropy": 5.324032440530168,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "winrm",
    "app_proto": "winrm",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5985,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 31,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "41fa5d82cf5e704b60baf3241e133cb99d9fe750",
    "event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
    "classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 31
    },
    "named_classification_skipped": false,
    "service_name": "winrm",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6bc969d25c0e82baf175a3ffaad43d8d",
        "path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
    },
    "target_context": {
        "dst_port": 5985,
        "service": "winrm",
        "service_name": "winrm",
        "risk_score": 31
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
        "classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a83130cf35afaf89251ab26cc1da250a468ceacd",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
        "port": 5985,
        "service": "winrm",
        "service_label_fr": "WINRM"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
    "attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
    "target_port_label": "5985 \u00b7 WINRM",
    "emulator_service": "winrm",
    "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 31\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 31
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 31,
        "risk_label": "Faible",
        "service_name": "winrm",
        "service_label_fr": "WINRM",
        "dst_port": 5985,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-winrm",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
            "port": 5985,
            "service": "winrm",
            "service_label_fr": "WINRM"
        },
        "attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5985\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
        "target_port_label": "5985 \u00b7 WINRM",
        "emulator_service": "winrm",
        "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "winrm",
        "service_banner": "honeypot-winrm",
        "service_os": "linux",
        "dst_port": "5985"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_winrm_probe",
        "winrm_emulated",
        "winrm_payload"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e312034303120556e617574686f72697a65640d0a5757572d41757468656e7469636174653a204e65676f74696174650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
    "emulator_response_len": 77,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "winrm",
    "app_proto": "winrm",
    "asn": 21859,
    "country": "PT",
    "dst_port": 5985,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "c549abcc3c12627af589696228cecd16670f21b5",
    "event_fingerprint": "69c3741eda286def0bdd9c17863648ff58bc3b2f",
    "classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "winrm",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "a98d2328dfdc853a4ac94ea7611b67e5"
    },
    "target_context": {
        "dst_port": 5985,
        "service": "winrm",
        "service_name": "winrm",
        "risk_score": 24
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "afb8fcf9ef5a81814179d51060cc7b145afadc8c",
    "protocol_details": {
        "port": 5985,
        "service": "winrm",
        "service_label_fr": "WINRM"
    },
    "attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
    "target_port_label": "5985 \u00b7 WINRM",
    "emulator_service": "winrm",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "winrm",
        "service_label_fr": "WINRM",
        "dst_port": 5985,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-winrm",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 5985,
            "service": "winrm",
            "service_label_fr": "WINRM"
        },
        "attack_vector": "winrm probe \u00b7 via WINRM:5985 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "5985 \u00b7 WINRM",
        "emulator_service": "winrm",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "winrm",
        "service_banner": "honeypot-winrm",
        "service_os": "linux",
        "dst_port": "5985"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_winrm_probe",
        "winrm_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "cassandra-thrift",
    "app_proto": "cassandra-thrift",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9160,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1933dafc26d0f227d26434e5c7bc8006f9a569ea",
    "event_fingerprint": "01804df643364bdc1606f971ae4b28eac77e55dd",
    "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-thrift",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494"
    },
    "target_context": {
        "dst_port": 9160,
        "service": "cassandra-thrift",
        "service_name": "cassandra-thrift",
        "risk_score": 34
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fffd88aff02016ca9d9c8d5ef37877aadf2be1eb",
    "protocol_details": {
        "port": 9160,
        "service": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT"
    },
    "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
    "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
    "emulator_service": "cassandra-thrift",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT",
        "dst_port": 9160,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-thrift",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 9160,
            "service": "cassandra-thrift",
            "service_label_fr": "CASSANDRA THRIFT"
        },
        "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
        "emulator_service": "cassandra-thrift",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_thrift",
        "service_banner": "honeypot-cassandra-thrift",
        "service_os": "linux",
        "dst_port": "9160"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "bytes_in": 215,
    "payload_entropy": 5.762789002166605,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "cassandra-thrift",
    "app_proto": "cassandra-thrift",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9160,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a849898c92a08d3cab5f32992358a435dce5183d",
    "event_fingerprint": "01804df643364bdc1606f971ae4b28eac77e55dd",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "cassandra-thrift",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "494e149c05e3858d784a76744ed79894",
        "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494",
        "ja3": "ea217b0edcd93778471552ba0b796f81",
        "ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "tls_version": "0x0303",
        "tls_cipher_count": 4,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "ea217b0edcd93778471552ba0b796f81",
    "tls_ja3": "771,4866-4867-4865-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2",
    "tls_ja4_hash": "20cfcea4d0b06a5e70878e2ac1bf55f4",
    "tls_ja4": "t13d0104_a77009cba1e2_1e298527d56b",
    "tls_version": "0x0303",
    "tls_cipher_count": 4,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9160,
        "service": "cassandra-thrift",
        "service_name": "cassandra-thrift",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffdK]\ufffd}\ufffd+\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffdi\u0005\u0005=4\u0013v\ufffd{l\u0664\ufffd\u0006Wu \ufffd\ufffd\ufffd\ufffdb\ufffd\u0016\ufffd2\ufffd\ufffdN\ufffd\ufffd6\ufffd\ufffd\ufffd \u001dMI\ufffd\u0007\ufffd'0\ufffdC\ufffd\u0005\u0003\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffdK]\ufffd}\ufffd+\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffdi\u0005\u0005=4\u0013v\ufffd{l\u0664\ufffd\u0006Wu \ufffd\ufffd\ufffd\ufffdb\ufffd\u0016\ufffd2\ufffd\ufffdN\ufffd\ufffd6\ufffd\ufffd\ufffd \u001dMI\ufffd\u0007\ufffd'0\ufffdC\ufffd\u0005\u0003\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u001e\u0000\u001c\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 b\ufffd=\ufffd \ufffd`:\ufffdV\u0015\ufffd\ufffd\ufffd1!\ufffd\u0015\ufffd\ufffdl\ufffdRA\ufffd\n\ufffd\ufffd n\ufffd^",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffdK]\ufffd}\ufffd+\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffdi\u0005\u0005=4\u0013v\ufffd{l\u0664\ufffd\u0006Wu \ufffd\ufffd\ufffd\ufffdb\ufffd\u0016\ufffd2\ufffd\ufffdN\ufffd\ufffd6\ufffd\ufffd\ufffd \u001dMI\ufffd\u0007\ufffd'0\ufffdC\ufffd\u0005\u0003\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bd84bd2c679b1f4009be7ca4ff83bf2c4206dbc7",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffdK]\ufffd}\ufffd+\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffdi\u0005\u0005=4\u0013v\ufffd{l\u0664\ufffd\u0006Wu \ufffd\ufffd\ufffd\ufffdb\ufffd\u0016\ufffd2\ufffd\ufffdN\ufffd\ufffd6\ufffd\ufffd\ufffd \u001dMI\ufffd\u0007\ufffd'0\ufffdC\ufffd\u0005\u0003\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
        "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "port": 9160,
        "service": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT"
    },
    "evidence_snippet": "\ufffd\ufffdS\ufffdK]\ufffd}\ufffd+\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffdi=4v\ufffd{l\u0664\ufffdWu \ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd2\ufffd\ufffdN\ufffd\ufffd6\ufffd\ufffd\ufffd MI\ufffd\ufffd'0\ufffdC\ufffd\ufffd}\n\n#",
    "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
    "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
    "emulator_service": "cassandra-thrift",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT",
        "dst_port": 9160,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-thrift",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffdK]\ufffd}\ufffd+\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffdi\u0005\u0005=4\u0013v\ufffd{l\u0664\ufffd\u0006Wu \ufffd\ufffd\ufffd\ufffdb\ufffd\u0016\ufffd2\ufffd\ufffdN\ufffd\ufffd6\ufffd\ufffd\ufffd \u001dMI\ufffd\u0007\ufffd'0\ufffdC\ufffd\u0005\u0003\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
            "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
            "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
            "port": 9160,
            "service": "cassandra-thrift",
            "service_label_fr": "CASSANDRA THRIFT"
        },
        "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdS\ufffdK]\ufffd}\ufffd+\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffdi=4v\ufffd{l\u0664\ufffdWu \ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd2\ufffd\ufffdN\ufffd\ufffd6\ufffd\ufffd\ufffd MI\ufffd\ufffd'0\ufffdC\ufffd\ufffd}\n\n#",
        "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
        "emulator_service": "cassandra-thrift",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_thrift",
        "service_banner": "honeypot-cassandra-thrift",
        "service_os": "linux",
        "dst_port": "9160"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "bytes_in": 162,
    "payload_entropy": 4.790234923166226,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "cassandra-thrift",
    "app_proto": "cassandra-thrift",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9160,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a849898c92a08d3cab5f32992358a435dce5183d",
    "event_fingerprint": "01804df643364bdc1606f971ae4b28eac77e55dd",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-thrift",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2eb2bed0998a66f0baf2c4b2160707c2",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
        "ja4": "a3533e7527e047470b74402d4bc8a6dd",
        "tls_version": "0x0303",
        "tls_cipher_count": 33,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "02f32644e1b0655c19aaa3a2d6778b1e",
    "tls_ja3": "771,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49162-49161-49160-49192-49191-49172-49171-49170-61-60-53-47-10-49159-49169-5-4-49195-49199-156,5-10-11-13-65281,23-24-25,0",
    "tls_ja4_hash": "a3533e7527e047470b74402d4bc8a6dd",
    "tls_ja4": "t13d0133_ad3470b4f447_40d2e578a3e2",
    "tls_version": "0x0303",
    "tls_cipher_count": 33,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9160,
        "service": "cassandra-thrift",
        "service_name": "cassandra-thrift",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGN}\u3534>|\u0674\u00b4\ufffd_k\ufffd\u0178\ufffd\ufffd\ufffd\u015db\ufffd1\ufffd\ufffd\ufffd$_\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGN}\u3534>|\u0674\u00b4\ufffd_k\ufffd\u0178\ufffd\ufffd\ufffd\u015db\ufffd1\ufffd\ufffd\ufffd$_\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\n\u0000\b\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGN}\u3534>|\u0674\u00b4\ufffd_k\ufffd\u0178\ufffd\ufffd\ufffd\u015db\ufffd1\ufffd\ufffd\ufffd$_\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "63ed060f630c3e6ddd66492cee22f3189ea0e471",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGN}\u3534>|\u0674\u00b4\ufffd_k\ufffd\u0178\ufffd\ufffd\ufffd\u015db\ufffd1\ufffd\ufffd\ufffd$_\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
        "tls_ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
        "tls_ja4": "a3533e7527e047470b74402d4bc8a6dd",
        "port": 9160,
        "service": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdGN}\u3534>|\u0674\u00b4\ufffd_k\ufffd\u0178\ufffd\ufffd\ufffd\u015db\ufffd1\ufffd\ufffd\ufffd$_B\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\ufffd(\ufffd'\ufffd\ufffd\ufffd=<5\/\n\ufffd\ufffd\ufffd+\ufffd\/\ufffd.",
    "attack_vector": "postgres probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
    "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
    "emulator_service": "cassandra-thrift",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT",
        "dst_port": 9160,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGN}\u3534>|\u0674\u00b4\ufffd_k\ufffd\u0178\ufffd\ufffd\ufffd\u015db\ufffd1\ufffd\ufffd\ufffd$_\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
            "tls_ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
            "tls_ja4": "a3533e7527e047470b74402d4bc8a6dd",
            "port": 9160,
            "service": "cassandra-thrift",
            "service_label_fr": "CASSANDRA THRIFT"
        },
        "attack_vector": "postgres probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdGN}\u3534>|\u0674\u00b4\ufffd_k\ufffd\u0178\ufffd\ufffd\ufffd\u015db\ufffd1\ufffd\ufffd\ufffd$_B\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\ufffd(\ufffd'\ufffd\ufffd\ufffd=<5\/\n\ufffd\ufffd\ufffd+\ufffd\/\ufffd.",
        "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
        "emulator_service": "cassandra-thrift",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_thrift",
        "service_banner": "honeypot-cassandra-thrift",
        "service_os": "linux",
        "dst_port": "9160"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "bytes_in": 176,
    "payload_entropy": 5.3169579377015515,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "cassandra-thrift",
    "app_proto": "cassandra-thrift",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9160,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 34,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "db0726dc13a6eb440383140bf708e09bd503158e",
    "event_fingerprint": "01804df643364bdc1606f971ae4b28eac77e55dd",
    "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-thrift",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "175c7c15a4faba122b0ac6fde17723be",
        "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494"
    },
    "target_context": {
        "dst_port": 9160,
        "service": "cassandra-thrift",
        "service_name": "cassandra-thrift",
        "risk_score": 34
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9160\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9160\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9160\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9160\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9160\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "52dca88d49f22ab58e4c55df12b1f0c2d90087fc",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9160\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
        "port": 9160,
        "service": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9160\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
    "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
    "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
    "emulator_service": "cassandra-thrift",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT",
        "dst_port": 9160,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9160\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
            "port": 9160,
            "service": "cassandra-thrift",
            "service_label_fr": "CASSANDRA THRIFT"
        },
        "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9160\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar",
        "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
        "emulator_service": "cassandra-thrift",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_thrift",
        "service_banner": "honeypot-cassandra-thrift",
        "service_os": "linux",
        "dst_port": "9160"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "http_get_probe",
        "mozi_pattern",
        "net_cassandra_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "cassandra-thrift",
    "app_proto": "cassandra-thrift",
    "asn": 21859,
    "country": "PT",
    "dst_port": 9160,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1933dafc26d0f227d26434e5c7bc8006f9a569ea",
    "event_fingerprint": "01804df643364bdc1606f971ae4b28eac77e55dd",
    "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-thrift",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494"
    },
    "target_context": {
        "dst_port": 9160,
        "service": "cassandra-thrift",
        "service_name": "cassandra-thrift",
        "risk_score": 34
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fffd88aff02016ca9d9c8d5ef37877aadf2be1eb",
    "protocol_details": {
        "port": 9160,
        "service": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT"
    },
    "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
    "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
    "emulator_service": "cassandra-thrift",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "cassandra-thrift",
        "service_label_fr": "CASSANDRA THRIFT",
        "dst_port": 9160,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 9160,
            "service": "cassandra-thrift",
            "service_label_fr": "CASSANDRA THRIFT"
        },
        "attack_vector": "cassandra probe \u00b7 via CASSANDRA THRIFT:9160 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9160 \u00b7 CASSANDRA THRIFT",
        "emulator_service": "cassandra-thrift",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_thrift",
        "service_banner": "honeypot-cassandra-thrift",
        "service_os": "linux",
        "dst_port": "9160"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742070726f66696e65745f696f20726561647920706f72743d32303534370d0a",
    "emulator_response_len": 43,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "profinet-io",
    "app_proto": "profinet-io",
    "asn": 21859,
    "country": "PT",
    "dst_port": 20547,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1aca12edf6a46883b06931b983ae14432c6eb19c",
    "event_fingerprint": "6045069f16cd1c700b6ad950aa1be9b1f342abf3",
    "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 89,
    "precision_signals": [
        "INT-OT-profinet-dcp-get",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-OT-profinet-dcp-get",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "profinet-io",
    "risk_confidence_factor": 79,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "91a3874ab1b56c7604b2303ecb7824d0"
    },
    "target_context": {
        "dst_port": 20547,
        "service": "profinet-io",
        "service_name": "profinet-io",
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "ics_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4a4b0377a2ca511a41ac6e6d7f046fce69c096a0",
    "protocol_details": {
        "port": 20547,
        "service": "profinet-io",
        "service_label_fr": "PROFINET IO"
    },
    "attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
    "target_port_label": "20547 \u00b7 PROFINET IO",
    "emulator_service": "profinet-io",
    "confidence_reason": "Confiance 79 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
        "classification_reason_label_fr": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "profinet-io",
        "service_label_fr": "PROFINET IO",
        "dst_port": 20547,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-OT-profinet-dcp-get",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Ot Profinet Dcp Get",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-profinet-io",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 20547,
            "service": "profinet-io",
            "service_label_fr": "PROFINET IO"
        },
        "attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "20547 \u00b7 PROFINET IO",
        "emulator_service": "profinet-io",
        "confidence_reason": "Confiance 79 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "profinet_io",
        "service_banner": "honeypot-profinet-io",
        "service_os": "linux",
        "dst_port": "20547"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_profinet_probe",
        "profinet_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742070726f66696e65745f696f20726561647920706f72743d32303534370d0a",
    "emulator_response_len": 43,
    "bytes_in": 1476,
    "payload_entropy": 7.7342081779431755,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "profinet-io",
    "app_proto": "profinet-io",
    "asn": 21859,
    "country": "PT",
    "dst_port": 20547,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "1a315892f0ab3f72d947ce87ddddbaad07aee969",
    "event_fingerprint": "6045069f16cd1c700b6ad950aa1be9b1f342abf3",
    "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 89,
    "precision_signals": [
        "INT-OT-profinet-dcp-get",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-OT-profinet-dcp-get",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "profinet-io",
    "risk_confidence_factor": 79,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4b2fd18077d8b4625cc6fb69f96e0183",
        "path_pattern_hash": "91a3874ab1b56c7604b2303ecb7824d0"
    },
    "target_context": {
        "dst_port": 20547,
        "service": "profinet-io",
        "service_name": "profinet-io",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001e\u001c^)D\ufffd\ufffdG-\"\u001bX'\ufffdJ=\u00a5 \ufffd\u0001\ufffd\ufffd\u0015\ufffdP\ufffd\u0003 L^\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd>\/U\ufffd\"\ufffdJ\ufffd\u0010\ufffd \ufffd\ufffd0~yK\ufffd\ufffdC\u0016\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001e\u001c^)D\ufffd\ufffdG-\"\u001bX'\ufffdJ=\u00a5 \ufffd\u0001\ufffd\ufffd\u0015\ufffdP\ufffd\u0003 L^\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd>\/U\ufffd\"\ufffdJ\ufffd\u0010\ufffd \ufffd\ufffd0~yK\ufffd\ufffdC\u0016\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffdXV\ufffd\ufffd\u0016\u000b\u0005\ufffd\ufffd0\ufffdt\u0019\ufffd\n!;\ufffd\u0004\u001dIWs{\ufffdW\u0006\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001e\u001c^)D\ufffd\ufffdG-\"\u001bX'\ufffdJ=\u00a5 \ufffd\u0001\ufffd\ufffd\u0015\ufffdP\ufffd\u0003 L^\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd>\/U\ufffd\"\ufffdJ\ufffd\u0010\ufffd \ufffd\ufffd0~yK\ufffd\ufffdC\u0016\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "ics_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a5fc0273337ffb00a3b8ba5ce567470fe87b68b7",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001e\u001c^)D\ufffd\ufffdG-\"\u001bX'\ufffdJ=\u00a5 \ufffd\u0001\ufffd\ufffd\u0015\ufffdP\ufffd\u0003 L^\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd>\/U\ufffd\"\ufffdJ\ufffd\u0010\ufffd \ufffd\ufffd0~yK\ufffd\ufffdC\u0016\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "port": 20547,
        "service": "profinet-io",
        "service_label_fr": "PROFINET IO"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd^)D\ufffd\ufffdG-\"X'\ufffdJ=\u00a5 \ufffd\ufffd\ufffd\ufffdP\ufffd L^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>\/U\ufffd\"\ufffdJ\ufffd\ufffd \ufffd\ufffd0~yK\ufffd\ufffdC&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL",
    "attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
    "target_port_label": "20547 \u00b7 PROFINET IO",
    "emulator_service": "profinet-io",
    "confidence_reason": "Confiance 79 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
        "classification_reason_label_fr": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "profinet-io",
        "service_label_fr": "PROFINET IO",
        "dst_port": 20547,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-OT-profinet-dcp-get",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Ot Profinet Dcp Get",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-profinet-io",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001e\u001c^)D\ufffd\ufffdG-\"\u001bX'\ufffdJ=\u00a5 \ufffd\u0001\ufffd\ufffd\u0015\ufffdP\ufffd\u0003 L^\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd>\/U\ufffd\"\ufffdJ\ufffd\u0010\ufffd \ufffd\ufffd0~yK\ufffd\ufffdC\u0016\u0015\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "port": 20547,
            "service": "profinet-io",
            "service_label_fr": "PROFINET IO"
        },
        "attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd^)D\ufffd\ufffdG-\"X'\ufffdJ=\u00a5 \ufffd\ufffd\ufffd\ufffdP\ufffd L^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>\/U\ufffd\"\ufffdJ\ufffd\ufffd \ufffd\ufffd0~yK\ufffd\ufffdC&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL",
        "target_port_label": "20547 \u00b7 PROFINET IO",
        "emulator_service": "profinet-io",
        "confidence_reason": "Confiance 79 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "profinet_io",
        "service_banner": "honeypot-profinet-io",
        "service_os": "linux",
        "dst_port": "20547"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_profinet_probe",
        "profinet_emulated",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742070726f66696e65745f696f20726561647920706f72743d32303534370d0a",
    "emulator_response_len": 43,
    "bytes_in": 162,
    "payload_entropy": 4.847303518831883,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "profinet-io",
    "app_proto": "profinet-io",
    "asn": 21859,
    "country": "PT",
    "dst_port": 20547,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "1a315892f0ab3f72d947ce87ddddbaad07aee969",
    "event_fingerprint": "6045069f16cd1c700b6ad950aa1be9b1f342abf3",
    "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 89,
    "precision_signals": [
        "INT-OT-profinet-dcp-get",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-OT-profinet-dcp-get",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "profinet-io",
    "risk_confidence_factor": 79,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b0628b1a366525aa23f359498f8e8318",
        "path_pattern_hash": "91a3874ab1b56c7604b2303ecb7824d0",
        "ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
        "ja4": "a3533e7527e047470b74402d4bc8a6dd",
        "tls_version": "0x0303",
        "tls_cipher_count": 33,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "02f32644e1b0655c19aaa3a2d6778b1e",
    "tls_ja3": "771,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49162-49161-49160-49192-49191-49172-49171-49170-61-60-53-47-10-49159-49169-5-4-49195-49199-156,5-10-11-13-65281,23-24-25,0",
    "tls_ja4_hash": "a3533e7527e047470b74402d4bc8a6dd",
    "tls_ja4": "t13d0133_ad3470b4f447_40d2e578a3e2",
    "tls_version": "0x0303",
    "tls_cipher_count": 33,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 20547,
        "service": "profinet-io",
        "service_name": "profinet-io",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTZ\ufffd\ufffd7~\ufffdp\ufffd\ufffdf\ufffdP\u0279WQ\ufffd\ufffd\u0012\r\u001e\ufffdr\ufffdlH\ufffd1+\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTZ\ufffd\ufffd7~\ufffdp\ufffd\ufffdf\ufffdP\u0279WQ\ufffd\ufffd\u0012\r\u001e\ufffdr\ufffdlH\ufffd1+\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\n\u0000\b\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTZ\ufffd\ufffd7~\ufffdp\ufffd\ufffdf\ufffdP\u0279WQ\ufffd\ufffd\u0012\r\u001e\ufffdr\ufffdlH\ufffd1+\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
        "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "ics_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d3ceb9746d6ede8069c60a41bd357cda5bc8b75d",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTZ\ufffd\ufffd7~\ufffdp\ufffd\ufffdf\ufffdP\u0279WQ\ufffd\ufffd\u0012\r\u001e\ufffdr\ufffdlH\ufffd1+\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
        "tls_ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
        "tls_ja4": "a3533e7527e047470b74402d4bc8a6dd",
        "port": 20547,
        "service": "profinet-io",
        "service_label_fr": "PROFINET IO"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdTZ\ufffd\ufffd7~\ufffdp\ufffd\ufffdf\ufffdP\u0279WQ\ufffd\ufffd\r\ufffdr\ufffdlH\ufffd1+\ufffdB\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\ufffd(\ufffd'\ufffd\ufffd\ufffd=<5\/\n\ufffd\ufffd\ufffd+\ufffd\/\ufffd.",
    "attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
    "target_port_label": "20547 \u00b7 PROFINET IO",
    "emulator_service": "profinet-io",
    "confidence_reason": "Confiance 79 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
        "classification_reason_label_fr": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "profinet-io",
        "service_label_fr": "PROFINET IO",
        "dst_port": 20547,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-OT-profinet-dcp-get",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Ot Profinet Dcp Get",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-profinet-io",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTZ\ufffd\ufffd7~\ufffdp\ufffd\ufffdf\ufffdP\u0279WQ\ufffd\ufffd\u0012\r\u001e\ufffdr\ufffdlH\ufffd1+\ufffd\u0000\u0000B\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\b\ufffd(\ufffd'\ufffd\u0014\ufffd\u0013\ufffd\u0012\u0000=\u0000<\u00005\u0000\/\u0000\n\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\ufffd+\ufffd\/\u0000\ufffd\u0001\u0000\u0000.\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000",
            "tls_ja3": "02f32644e1b0655c19aaa3a2d6778b1e",
            "tls_ja4": "a3533e7527e047470b74402d4bc8a6dd",
            "port": 20547,
            "service": "profinet-io",
            "service_label_fr": "PROFINET IO"
        },
        "attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdTZ\ufffd\ufffd7~\ufffdp\ufffd\ufffdf\ufffdP\u0279WQ\ufffd\ufffd\r\ufffdr\ufffdlH\ufffd1+\ufffdB\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\n\ufffd\t\ufffd\ufffd(\ufffd'\ufffd\ufffd\ufffd=<5\/\n\ufffd\ufffd\ufffd+\ufffd\/\ufffd.",
        "target_port_label": "20547 \u00b7 PROFINET IO",
        "emulator_service": "profinet-io",
        "confidence_reason": "Confiance 79 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "profinet_io",
        "service_banner": "honeypot-profinet-io",
        "service_os": "linux",
        "dst_port": "20547"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_profinet_probe",
        "profinet_emulated",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742070726f66696e65745f696f20726561647920706f72743d32303534370d0a",
    "emulator_response_len": 43,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "profinet-io",
    "app_proto": "profinet-io",
    "asn": 21859,
    "country": "PT",
    "dst_port": 20547,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1aca12edf6a46883b06931b983ae14432c6eb19c",
    "event_fingerprint": "6045069f16cd1c700b6ad950aa1be9b1f342abf3",
    "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "precision_score": 89,
    "precision_signals": [
        "INT-OT-profinet-dcp-get",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-OT-profinet-dcp-get",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "profinet-io",
    "risk_confidence_factor": 79,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "91a3874ab1b56c7604b2303ecb7824d0"
    },
    "target_context": {
        "dst_port": 20547,
        "service": "profinet-io",
        "service_name": "profinet-io",
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "ics_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4a4b0377a2ca511a41ac6e6d7f046fce69c096a0",
    "protocol_details": {
        "port": 20547,
        "service": "profinet-io",
        "service_label_fr": "PROFINET IO"
    },
    "attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
    "target_port_label": "20547 \u00b7 PROFINET IO",
    "emulator_service": "profinet-io",
    "confidence_reason": "Confiance 79 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
        "classification_reason_label_fr": "Type \u00ab profinet_probe \u00bb (signaux protocolaires) \u00b7 confiance 79%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "profinet-io",
        "service_label_fr": "PROFINET IO",
        "dst_port": 20547,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-OT-profinet-dcp-get",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Ot Profinet Dcp Get",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-profinet-io",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 20547,
            "service": "profinet-io",
            "service_label_fr": "PROFINET IO"
        },
        "attack_vector": "profinet probe \u00b7 via PROFINET IO:20547 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "20547 \u00b7 PROFINET IO",
        "emulator_service": "profinet-io",
        "confidence_reason": "Confiance 79 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "profinet_io",
        "service_banner": "honeypot-profinet-io",
        "service_os": "linux",
        "dst_port": "20547"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_profinet_probe",
        "profinet_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000010000000000000000000000000",
    "emulator_response_len": 16,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "i2p",
    "app_proto": "i2p",
    "asn": 21859,
    "country": "PT",
    "dst_port": 4444,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "9af9a8526e404bdf6e50fb047fd3be7c5fa4845b",
    "event_fingerprint": "6184803cbed361f58b909ed8bd1c95271e8c683c",
    "classification_reason": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "i2p",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "63fac6162f0d2de1da7489cc7f99c131"
    },
    "target_context": {
        "dst_port": 4444,
        "service": "i2p",
        "service_name": "i2p",
        "risk_score": 24
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3eea5d2fe930464ddc8e6da588c9833b700913b9",
    "protocol_details": {
        "port": 4444,
        "service": "i2p",
        "service_label_fr": "I2P"
    },
    "attack_vector": "i2p probe \u00b7 via I2P:4444 \u00b7 (sonde \/ probe)",
    "target_port_label": "4444 \u00b7 I2P",
    "emulator_service": "i2p",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "i2p",
        "service_label_fr": "I2P",
        "dst_port": 4444,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-i2p",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 4444,
            "service": "i2p",
            "service_label_fr": "I2P"
        },
        "attack_vector": "i2p probe \u00b7 via I2P:4444 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4444 \u00b7 I2P",
        "emulator_service": "i2p",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "i2p",
        "service_banner": "honeypot-i2p",
        "service_os": "linux",
        "dst_port": "4444"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "i2p_emulated",
        "net_i2p_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000010000000000000000000000000",
    "emulator_response_len": 16,
    "bytes_in": 215,
    "payload_entropy": 5.85360027096674,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "i2p",
    "app_proto": "i2p",
    "asn": 21859,
    "country": "PT",
    "dst_port": 4444,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "304f3ffd9d07028a5a9bd31bde61a37c016e139a",
    "event_fingerprint": "6184803cbed361f58b909ed8bd1c95271e8c683c",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "service_name": "i2p",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1078f6edea6dc641848148c92a0ea973",
        "path_pattern_hash": "63fac6162f0d2de1da7489cc7f99c131",
        "ja3": "ea217b0edcd93778471552ba0b796f81",
        "ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "tls_version": "0x0303",
        "tls_cipher_count": 4,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "ea217b0edcd93778471552ba0b796f81",
    "tls_ja3": "771,4866-4867-4865-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2",
    "tls_ja4_hash": "20cfcea4d0b06a5e70878e2ac1bf55f4",
    "tls_ja4": "t13d0104_a77009cba1e2_1e298527d56b",
    "tls_version": "0x0303",
    "tls_cipher_count": 4,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 4444,
        "service": "i2p",
        "service_name": "i2p",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdJ\ufffdX,\ufffdK\ufffd\u0007\"\ufffd\ufffd\ub38a\u05417\u0006\ufffd\ufffde\ufffdg@!\\\u00116S% \ufffd\ufffdjs\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$l\ufffd,\ufffd\ufffd`m\u0016 \ufffd\ufffd}$\ufffd\ufffd\ufffdt+\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdJ\ufffdX,\ufffdK\ufffd\u0007\"\ufffd\ufffd\ub38a\u05417\u0006\ufffd\ufffde\ufffdg@!\\\u00116S% \ufffd\ufffdjs\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$l\ufffd,\ufffd\ufffd`m\u0016 \ufffd\ufffd}$\ufffd\ufffd\ufffdt+\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u001e\u0000\u001c\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdL\u04d7z\ufffdIZ\u000blta\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd)\ufffdn\ufffd\ufffdG\ufffd<e\ufffdi",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdJ\ufffdX,\ufffdK\ufffd\u0007\"\ufffd\ufffd\ub38a\u05417\u0006\ufffd\ufffde\ufffdg@!\\\u00116S% \ufffd\ufffdjs\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$l\ufffd,\ufffd\ufffd`m\u0016 \ufffd\ufffd}$\ufffd\ufffd\ufffdt+\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "afb57cb62c04d5392a84511d8dacbe8400782fc9",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdJ\ufffdX,\ufffdK\ufffd\u0007\"\ufffd\ufffd\ub38a\u05417\u0006\ufffd\ufffde\ufffdg@!\\\u00116S% \ufffd\ufffdjs\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$l\ufffd,\ufffd\ufffd`m\u0016 \ufffd\ufffd}$\ufffd\ufffd\ufffdt+\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
        "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "port": 4444,
        "service": "i2p",
        "service_label_fr": "I2P"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdJ\ufffdX,\ufffdK\ufffd\"\ufffd\ufffd\ub38a\u05417\ufffd\ufffde\ufffdg@!\\6S% \ufffd\ufffdjs\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$l\ufffd,\ufffd\ufffd`m \ufffd\ufffd}$\ufffd\ufffd\ufffdt+\ufffd}\n\n#",
    "attack_vector": "i2p probe \u00b7 via I2P:4444 \u00b7 (sonde \/ probe)",
    "target_port_label": "4444 \u00b7 I2P",
    "emulator_service": "i2p",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "i2p",
        "service_label_fr": "I2P",
        "dst_port": 4444,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-i2p",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdJ\ufffdX,\ufffdK\ufffd\u0007\"\ufffd\ufffd\ub38a\u05417\u0006\ufffd\ufffde\ufffdg@!\\\u00116S% \ufffd\ufffdjs\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$l\ufffd,\ufffd\ufffd`m\u0016 \ufffd\ufffd}$\ufffd\ufffd\ufffdt+\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
            "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
            "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
            "port": 4444,
            "service": "i2p",
            "service_label_fr": "I2P"
        },
        "attack_vector": "i2p probe \u00b7 via I2P:4444 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdJ\ufffdX,\ufffdK\ufffd\"\ufffd\ufffd\ub38a\u05417\ufffd\ufffde\ufffdg@!\\6S% \ufffd\ufffdjs\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$l\ufffd,\ufffd\ufffd`m \ufffd\ufffd}$\ufffd\ufffd\ufffdt+\ufffd}\n\n#",
        "target_port_label": "4444 \u00b7 I2P",
        "emulator_service": "i2p",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "i2p",
        "service_banner": "honeypot-i2p",
        "service_os": "linux",
        "dst_port": "4444"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "i2p_emulated",
        "i2p_payload",
        "net_i2p_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000010000000000000000000000000",
    "emulator_response_len": 16,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "i2p",
    "app_proto": "i2p",
    "asn": 21859,
    "country": "PT",
    "dst_port": 4444,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 41,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "6af26dc25c428035a5593d58d3355141382f051f",
    "event_fingerprint": "6184803cbed361f58b909ed8bd1c95271e8c683c",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0391"
    ],
    "kb_rule_ids": [
        "pat-0391"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 41,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "ssh_probe",
    "service_name": "i2p",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "1dee208d404a0dde93cc312da8c55348"
    },
    "target_context": {
        "dst_port": 4444,
        "service": "i2p",
        "service_name": "i2p",
        "risk_score": 41
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c331e9ca49f9b9a71366f9dc1a867224cc2ae7d7",
    "protocol_details": {
        "payload_preview": "SSH-2.0-Go",
        "port": 4444,
        "service": "i2p",
        "service_label_fr": "I2P"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "port 4444 tcp \u00b7 via I2P:4444 \u00b7 (sonde \/ probe)",
    "target_port_label": "4444 \u00b7 I2P",
    "emulator_service": "i2p",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 41,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 41,
        "risk_label": "Moyen",
        "service_name": "i2p",
        "service_label_fr": "I2P",
        "dst_port": 4444,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391"
        ],
        "tags_summary_labels_fr": [
            "pat-0391"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-i2p",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "SSH-2.0-Go",
            "port": 4444,
            "service": "i2p",
            "service_label_fr": "I2P"
        },
        "attack_vector": "port 4444 tcp \u00b7 via I2P:4444 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "4444 \u00b7 I2P",
        "emulator_service": "i2p",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "i2p",
        "service_banner": "honeypot-i2p",
        "service_os": "linux",
        "dst_port": "4444"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "i2p_emulated",
        "i2p_payload",
        "net_i2p_probe",
        "ssh_banner"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "00000010000000000000000000000000",
    "emulator_response_len": 16,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "i2p",
    "app_proto": "i2p",
    "asn": 21859,
    "country": "PT",
    "dst_port": 4444,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "9af9a8526e404bdf6e50fb047fd3be7c5fa4845b",
    "event_fingerprint": "6184803cbed361f58b909ed8bd1c95271e8c683c",
    "classification_reason": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "i2p",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "63fac6162f0d2de1da7489cc7f99c131"
    },
    "target_context": {
        "dst_port": 4444,
        "service": "i2p",
        "service_name": "i2p",
        "risk_score": 24
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3eea5d2fe930464ddc8e6da588c9833b700913b9",
    "protocol_details": {
        "port": 4444,
        "service": "i2p",
        "service_label_fr": "I2P"
    },
    "attack_vector": "i2p probe \u00b7 via I2P:4444 \u00b7 (sonde \/ probe)",
    "target_port_label": "4444 \u00b7 I2P",
    "emulator_service": "i2p",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "i2p",
        "service_label_fr": "I2P",
        "dst_port": 4444,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-i2p",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 4444,
            "service": "i2p",
            "service_label_fr": "I2P"
        },
        "attack_vector": "i2p probe \u00b7 via I2P:4444 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4444 \u00b7 I2P",
        "emulator_service": "i2p",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "i2p",
        "service_banner": "honeypot-i2p",
        "service_os": "linux",
        "dst_port": "4444"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "i2p_emulated",
        "net_i2p_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4e001550726f746f636f6c00044a524d4900004b000000020000",
    "emulator_response_len": 26,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "java-rmi",
    "app_proto": "java-rmi",
    "asn": 21859,
    "country": "PT",
    "dst_port": 1099,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "6ba91bf0c3a820d1f13a05825c47046ee36418fb",
    "event_fingerprint": "14024263f63aed3ddb99707dcfb7b22d80405c88",
    "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%",
    "confidence": 0.86,
    "classification_confidence": 0.86,
    "precision_score": 85,
    "precision_signals": [
        "INT-java_rmi",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-java_rmi",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 32,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "java-rmi",
    "risk_confidence_factor": 76,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f"
    },
    "target_context": {
        "dst_port": 1099,
        "service": "java-rmi",
        "service_name": "java-rmi",
        "risk_score": 32
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c112bc96e4979acbde0a0386a046736985e85fd0",
    "protocol_details": {
        "port": 1099,
        "service": "java-rmi",
        "service_label_fr": "JAVA RMI"
    },
    "attack_vector": "java rmi probe \u00b7 via JAVA RMI:1099 \u00b7 (sonde \/ probe)",
    "target_port_label": "1099 \u00b7 JAVA RMI",
    "emulator_service": "java-rmi",
    "confidence_reason": "Confiance 76 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%",
        "classification_reason_label_fr": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 86,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 32,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "java-rmi",
        "service_label_fr": "JAVA RMI",
        "dst_port": 1099,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-java_rmi",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Java Rmi",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-java-rmi",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 1099,
            "service": "java-rmi",
            "service_label_fr": "JAVA RMI"
        },
        "attack_vector": "java rmi probe \u00b7 via JAVA RMI:1099 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1099 \u00b7 JAVA RMI",
        "emulator_service": "java-rmi",
        "confidence_reason": "Confiance 76 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 86 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "java_rmi",
        "service_banner": "honeypot-java-rmi",
        "service_os": "linux",
        "dst_port": "1099"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "java_rmi_emulated",
        "net_java_rmi_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4e001550726f746f636f6c00044a524d4900004b000000020000",
    "emulator_response_len": 26,
    "bytes_in": 215,
    "payload_entropy": 5.790790332939335,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "java-rmi",
    "app_proto": "java-rmi",
    "asn": 21859,
    "country": "PT",
    "dst_port": 1099,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "5c9451b3c992842394dd12150a069c1df30faee1",
    "event_fingerprint": "14024263f63aed3ddb99707dcfb7b22d80405c88",
    "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%",
    "confidence": 0.86,
    "classification_confidence": 0.86,
    "precision_score": 85,
    "precision_signals": [
        "INT-java_rmi",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-java_rmi",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 32,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "java-rmi",
    "risk_confidence_factor": 76,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "cbcc4412db7aa034e5930e92470b9134",
        "path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f",
        "ja3": "ea217b0edcd93778471552ba0b796f81",
        "ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "tls_version": "0x0303",
        "tls_cipher_count": 4,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "ea217b0edcd93778471552ba0b796f81",
    "tls_ja3": "771,4866-4867-4865-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2",
    "tls_ja4_hash": "20cfcea4d0b06a5e70878e2ac1bf55f4",
    "tls_ja4": "t13d0104_a77009cba1e2_1e298527d56b",
    "tls_version": "0x0303",
    "tls_cipher_count": 4,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 1099,
        "service": "java-rmi",
        "service_name": "java-rmi",
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z\u001c\ufffd@\b\ufffd\t\t\ufffdy@\ufffd4\ufffd\ufffd;\ufffde\f\"\ufffd\u01e3;\ufffd\ufffd\u0016d\ufffd\ufffdq? \ufffdJ\ufffdi\u0704\ufffd+t^\ufffd\ufffd\ufffd\u000b?3\ufffdDVi!\ufffdw\ufffdENPF\ufffd\ufffd!\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z\u001c\ufffd@\b\ufffd\t\t\ufffdy@\ufffd4\ufffd\ufffd;\ufffde\f\"\ufffd\u01e3;\ufffd\ufffd\u0016d\ufffd\ufffdq? \ufffdJ\ufffdi\u0704\ufffd+t^\ufffd\ufffd\ufffd\u000b?3\ufffdDVi!\ufffdw\ufffdENPF\ufffd\ufffd!\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u001e\u0000\u001c\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0000+\u0000\u0003\u0002\u0003\u0004\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdhk\u0010\u0001<Qxj>G\u000e\ufffd\u0006)\u0017\u0005t\ufffd\ufffd\u000b\u0019\ufffd\ufffd\ufffd_]j\ufffd\ufffde(",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z\u001c\ufffd@\b\ufffd\t\t\ufffdy@\ufffd4\ufffd\ufffd;\ufffde\f\"\ufffd\u01e3;\ufffd\ufffd\u0016d\ufffd\ufffdq? \ufffdJ\ufffdi\u0704\ufffd+t^\ufffd\ufffd\ufffd\u000b?3\ufffdDVi!\ufffdw\ufffdENPF\ufffd\ufffd!\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "eda2a5cccf55b1cc9e264f0279924c394c8d9c2c",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z\u001c\ufffd@\b\ufffd\t\t\ufffdy@\ufffd4\ufffd\ufffd;\ufffde\f\"\ufffd\u01e3;\ufffd\ufffd\u0016d\ufffd\ufffdq? \ufffdJ\ufffdi\u0704\ufffd+t^\ufffd\ufffd\ufffd\u000b?3\ufffdDVi!\ufffdw\ufffdENPF\ufffd\ufffd!\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
        "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
        "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
        "port": 1099,
        "service": "java-rmi",
        "service_label_fr": "JAVA RMI"
    },
    "evidence_snippet": "\ufffd\ufffdz\ufffd@\ufffd\t\t\ufffdy@\ufffd4\ufffd\ufffd;\ufffde\"\ufffd\u01e3;\ufffd\ufffdd\ufffd\ufffdq? \ufffdJ\ufffdi\u0704\ufffd+t^\ufffd\ufffd\ufffd?3\ufffdDVi!\ufffdw\ufffdENPF\ufffd\ufffd!\ufffd\ufffd}\n\n#",
    "attack_vector": "java rmi probe \u00b7 via JAVA RMI:1099 \u00b7 (sonde \/ probe)",
    "target_port_label": "1099 \u00b7 JAVA RMI",
    "emulator_service": "java-rmi",
    "confidence_reason": "Confiance 76 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%",
        "classification_reason_label_fr": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 86,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 32,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "java-rmi",
        "service_label_fr": "JAVA RMI",
        "dst_port": 1099,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-java_rmi",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Java Rmi",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-java-rmi",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z\u001c\ufffd@\b\ufffd\t\t\ufffdy@\ufffd4\ufffd\ufffd;\ufffde\f\"\ufffd\u01e3;\ufffd\ufffd\u0016d\ufffd\ufffdq? \ufffdJ\ufffdi\u0704\ufffd+t^\ufffd\ufffd\ufffd\u000b?3\ufffdDVi!\ufffdw\ufffdENPF\ufffd\ufffd!\ufffd\u0000\b\u0013\u0002\u0013\u0003\u0013\u0001\u0000\ufffd\u0001\u0000\u0000}\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000",
            "tls_ja3": "ea217b0edcd93778471552ba0b796f81",
            "tls_ja4": "20cfcea4d0b06a5e70878e2ac1bf55f4",
            "port": 1099,
            "service": "java-rmi",
            "service_label_fr": "JAVA RMI"
        },
        "attack_vector": "java rmi probe \u00b7 via JAVA RMI:1099 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdz\ufffd@\ufffd\t\t\ufffdy@\ufffd4\ufffd\ufffd;\ufffde\"\ufffd\u01e3;\ufffd\ufffdd\ufffd\ufffdq? \ufffdJ\ufffdi\u0704\ufffd+t^\ufffd\ufffd\ufffd?3\ufffdDVi!\ufffdw\ufffdENPF\ufffd\ufffd!\ufffd\ufffd}\n\n#",
        "target_port_label": "1099 \u00b7 JAVA RMI",
        "emulator_service": "java-rmi",
        "confidence_reason": "Confiance 76 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 86 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "java_rmi",
        "service_banner": "honeypot-java-rmi",
        "service_os": "linux",
        "dst_port": "1099"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "java_rmi_emulated",
        "net_java_rmi_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4e001550726f746f636f6c00044a524d4900004b000000020000",
    "emulator_response_len": 26,
    "bytes_in": 159,
    "payload_entropy": 4.642344409457223,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "java-rmi",
    "app_proto": "java-rmi",
    "asn": 21859,
    "country": "PT",
    "dst_port": 1099,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "5c9451b3c992842394dd12150a069c1df30faee1",
    "event_fingerprint": "14024263f63aed3ddb99707dcfb7b22d80405c88",
    "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%",
    "confidence": 0.86,
    "classification_confidence": 0.86,
    "precision_score": 85,
    "precision_signals": [
        "INT-java_rmi",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-java_rmi",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 32,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "java-rmi",
    "risk_confidence_factor": 76,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e3c7c4c6f8232c6435fa3bb25c8c398f",
        "path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f",
        "ja3": "caaddd3ed0a315543d761490b01b08e0",
        "ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
        "tls_version": "0x0303",
        "tls_cipher_count": 13,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "caaddd3ed0a315543d761490b01b08e0",
    "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281-15-18,23-24-25,0",
    "tls_ja4_hash": "15b6611f90c03a9f6b2a99be9ffb1608",
    "tls_ja4": "t13d0113_5fb62fe3077b_40d2e578a3e2",
    "tls_version": "0x0303",
    "tls_cipher_count": 13,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 1099,
        "service": "java-rmi",
        "service_name": "java-rmi",
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003D\ufffd\u000bNb\u00173j\ufffdb\ufffd\ufffdL\ufffd2`\ufffd\ufffd\ufffd+]\ufffd,\ufffdo\u0001W\ufffd\ufffdAo\b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003D\ufffd\u000bNb\u00173j\ufffdb\ufffd\ufffdL\ufffd2`\ufffd\ufffd\ufffd+]\ufffd,\ufffdo\u0001W\ufffd\ufffdAo\b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0001\u0001\u0001\u0003\u0001\u0002\ufffd\u0001\u0000\u0001\u0000\u0000\u000f\u0000\u0001\u0001\u0000\u0012\u0000\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003D\ufffd\u000bNb\u00173j\ufffdb\ufffd\ufffdL\ufffd2`\ufffd\ufffd\ufffd+]\ufffd,\ufffdo\u0001W\ufffd\ufffdAo\b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
        "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1fa5c7032babd158cd4d7f4a5c3849163f2fb813",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003D\ufffd\u000bNb\u00173j\ufffdb\ufffd\ufffdL\ufffd2`\ufffd\ufffd\ufffd+]\ufffd,\ufffdo\u0001W\ufffd\ufffdAo\b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
        "tls_ja3": "caaddd3ed0a315543d761490b01b08e0",
        "tls_ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
        "port": 1099,
        "service": "java-rmi",
        "service_label_fr": "JAVA RMI"
    },
    "evidence_snippet": "\ufffd\ufffdD\ufffdNb3j\ufffdb\ufffd\ufffdL\ufffd2`\ufffd\ufffd\ufffd+]\ufffd,\ufffdoW\ufffd\ufffdAo\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\nS\n\r&$",
    "attack_vector": "java rmi probe \u00b7 via JAVA RMI:1099 \u00b7 (sonde \/ probe)",
    "target_port_label": "1099 \u00b7 JAVA RMI",
    "emulator_service": "java-rmi",
    "confidence_reason": "Confiance 76 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%",
        "classification_reason_label_fr": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 76%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 86,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 32,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "java-rmi",
        "service_label_fr": "JAVA RMI",
        "dst_port": 1099,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-java_rmi",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Java Rmi",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-java-rmi",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003D\ufffd\u000bNb\u00173j\ufffdb\ufffd\ufffdL\ufffd2`\ufffd\ufffd\ufffd+]\ufffd,\ufffdo\u0001W\ufffd\ufffdAo\b\u0000\u0000\u001a\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\u0001\u0000\u0000S\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000&\u0000$\u0006\u0001\u0006\u0003\u0006\u0002\u0005\u0001\u0005\u0003\u0005\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0003",
            "tls_ja3": "caaddd3ed0a315543d761490b01b08e0",
            "tls_ja4": "15b6611f90c03a9f6b2a99be9ffb1608",
            "port": 1099,
            "service": "java-rmi",
            "service_label_fr": "JAVA RMI"
        },
        "attack_vector": "java rmi probe \u00b7 via JAVA RMI:1099 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdD\ufffdNb3j\ufffdb\ufffd\ufffdL\ufffd2`\ufffd\ufffd\ufffd+]\ufffd,\ufffdoW\ufffd\ufffdAo\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\nS\n\r&$",
        "target_port_label": "1099 \u00b7 JAVA RMI",
        "emulator_service": "java-rmi",
        "confidence_reason": "Confiance 76 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 86 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "java_rmi",
        "service_banner": "honeypot-java-rmi",
        "service_os": "linux",
        "dst_port": "1099"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "java_rmi_emulated",
        "net_java_rmi_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4e001550726f746f636f6c00044a524d4900004b000000020000",
    "emulator_response_len": 26,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "registered",
    "org": "Zenlayer Inc",
    "service": "java-rmi",
    "app_proto": "java-rmi",
    "asn": 21859,
    "country": "PT",
    "dst_port": 1099,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "906f2f31b588d0be2dbda6994f03e96ab3f9ab51",
    "event_fingerprint": "14024263f63aed3ddb99707dcfb7b22d80405c88",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 76%",
    "confidence": 0.86,
    "classification_confidence": 0.86,
    "precision_score": 85,
    "precision_signals": [
        "INT-java_rmi",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-java_rmi",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 32,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "java-rmi",
    "risk_confidence_factor": 76,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "PT",
        "asn": 21859,
        "org": "Zenlayer Inc",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f"
    },
    "target_context": {
        "dst_port": 1099,
        "service": "java-rmi",
        "service_name": "java-rmi",
        "risk_score": 32
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 76%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d072c6d63836b8c3b90881a939e4710d0cfbc455",
    "protocol_details": {
        "payload_preview": "SSH-2.0-Go",
        "port": 1099,
        "service": "java-rmi",
        "service_label_fr": "JAVA RMI"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "java rmi probe \u00b7 via JAVA RMI:1099 \u00b7 (sonde \/ probe)",
    "target_port_label": "1099 \u00b7 JAVA RMI",
    "emulator_service": "java-rmi",
    "confidence_reason": "Confiance 76 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 76%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 76%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 86,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 32,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "java-rmi",
        "service_label_fr": "JAVA RMI",
        "dst_port": 1099,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-java_rmi",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Java Rmi",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-java-rmi",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "SSH-2.0-Go",
            "port": 1099,
            "service": "java-rmi",
            "service_label_fr": "JAVA RMI"
        },
        "attack_vector": "java rmi probe \u00b7 via JAVA RMI:1099 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "1099 \u00b7 JAVA RMI",
        "emulator_service": "java-rmi",
        "confidence_reason": "Confiance 76 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 86 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (185.180.141.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "java_rmi",
        "service_banner": "honeypot-java-rmi",
        "service_os": "linux",
        "dst_port": "1099"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "185.180.141.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "java_rmi_emulated",
        "net_java_rmi_probe",
        "ssh_banner"
    ]
}