19/07/2026 20:07:03 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 203,
"payload_entropy": 5.392218573997077,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0d715571a8f7ed90c8af712d37c338e8",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 ",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6fd7d6c374bd9e31603d96c790efecf6bf05166c",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
19/07/2026 18:33:06 UTC
TCP
9200 · ELASTICSEARCH
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)
Élevée
Faible · 22
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Sonde Elasticsearch (REST)
Émulateur
ELASTICSEARCH
WAF
—
Recommandation
Surveiller
Tags
elasticsearch_emulated
net_elasticsearch_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9200
Chemin / cible
—
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 22
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 42366,
"country": "DE",
"dst_port": 9200,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 22,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "6dfec99b98d53481ee9b4cf1a1a54e12b0341ca9",
"event_fingerprint": "64ce65412bf1b81fa23464b76dd480979155e3d0",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 22
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 22
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "191a0c390e0c8bb3045189c33e41a4f22e6ddf86",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 22
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 22,
"risk_label": "Faible",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"elasticsearch_emulated",
"net_elasticsearch_probe"
]
}
19/07/2026 16:31:28 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 187,
"payload_entropy": 5.474598108723163,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6843f29b423188e20f8d9dabc2bc6f07",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "326473251e7a9833a508a670b17d4dd2fc20bc16",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
19/07/2026 14:44:43 UTC
TCP
9200 · ELASTICSEARCH
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices
Élevée
Moyen · 55
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices?format=json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
ELASTICSEARCH
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950607:elastic-cat
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 49 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0342
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES cat indices
Ligne de requête
GET /_cat/indices?format=json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?format=json HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /_cat/indices?format=json HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "88da84b12a904b3b33e36792a361fcbef2c81091",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "370cae99942aa27e42f71117e2dde07013b646f5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.45845907770515,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 42366,
"country": "DE",
"dst_port": 9200,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25
},
"risk_score": 55,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "34d819fcbda94306efcad968f6c5b5f6a154c4ba",
"event_fingerprint": "215fef5602d81d0cd1ab4291d89cd82e15aaa3ba",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0342"
],
"kb_rule_ids": [
"pat-0342"
],
"matched_patterns": [
"pat-0342"
],
"matched_pattern_names": [
"ES cat indices"
],
"pattern_ids": [
"pat-0342"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "51381b4b24c9f0c7c3af362c0b44513f",
"payload_hash": "e400a7cd42a0e4c7f17310e8e2fd3737",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 55
},
"payload_preview": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7af6c492262ec4d7f2817899b3e2061470c0d2da",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via ELASTICSEARCH",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0342"
],
"tags_summary_labels_fr": [
"pat-0342"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"net_elasticsearch_probe"
]
}
19/07/2026 13:50:37 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Fi
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Fi
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 166,
"payload_entropy": 5.3117509759011385,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e36de4d8d49ff42aecd97d73d3ed659b",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Fi",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Fi",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Fi",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "239f70316cd90d9e0544534eee924b23eeee4458",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Fi",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Fi",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Fi",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Fi",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
19/07/2026 11:06:19 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
net_couchdb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.9,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "88ce2e41f896410db67033686b9ce9e920f7f3a6",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd15953b0b902a8f240231f4ea2815ec6be92ba5",
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"net_couchdb_probe"
]
}
19/07/2026 08:49:04 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KH
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KH
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 200,
"payload_entropy": 5.391530616582246,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "532c7f9c9c9a43c89751abf24621709b",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KH",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KH",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KH",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d87c0d15c58edb1afc643d617ca1e645d6df787f",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KH",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KH",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KH",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KH",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
19/07/2026 07:26:29 UTC
TCP
9200 · ELASTICSEARCH
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices
Élevée
Moyen · 55
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices?format=json UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
ELASTICSEARCH
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950607:elastic-cat
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 49 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0342
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES cat indices
Ligne de requête
GET /_cat/indices?format=json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?format=json HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit
Requête brute (extrait)
GET /_cat/indices?format=json HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "7f9266821a63996f14248f3b46da5e6ba22f2c3f",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "370cae99942aa27e42f71117e2dde07013b646f5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 220,
"payload_entropy": 5.510572597739355,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 42366,
"country": "DE",
"dst_port": 9200,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25
},
"risk_score": 55,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "34d819fcbda94306efcad968f6c5b5f6a154c4ba",
"event_fingerprint": "215fef5602d81d0cd1ab4291d89cd82e15aaa3ba",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0342"
],
"kb_rule_ids": [
"pat-0342"
],
"matched_patterns": [
"pat-0342"
],
"matched_pattern_names": [
"ES cat indices"
],
"pattern_ids": [
"pat-0342"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e18f51d59a68bddc9e30b68898cdbc35",
"payload_hash": "ed6abab193f2e6c74338b50ff14bcf4a",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 55
},
"payload_preview": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b41ac7c6deb24dfbad81248c97d87ee0848aa2ea",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via ELASTICSEARCH",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0342"
],
"tags_summary_labels_fr": [
"pat-0342"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"net_elasticsearch_probe"
]
}
19/07/2026 06:41:15 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTM
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 207,
"payload_entropy": 5.423326519137788,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "08d9982e77f536b4934a60f9111977f1",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c6723a00e3bdafd5df6037f0715e13ef325e1b8",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTM",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
19/07/2026 05:25:22 UTC
TCP
9200 · ELASTICSEARCH
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices
Élevée
Moyen · 55
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices?format=json UA Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36…
Émulateur
ELASTICSEARCH
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950607:elastic-cat
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 49 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0342
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES cat indices
Ligne de requête
GET /_cat/indices?format=json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?format=json HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWeb
Requête brute (extrait)
GET /_cat/indices?format=json HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "fbc0a46f9c2e144fc770fef4de21ffe725652a28",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "370cae99942aa27e42f71117e2dde07013b646f5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 223,
"payload_entropy": 5.450373343633224,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 42366,
"country": "DE",
"dst_port": 9200,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25
},
"risk_score": 55,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "34d819fcbda94306efcad968f6c5b5f6a154c4ba",
"event_fingerprint": "215fef5602d81d0cd1ab4291d89cd82e15aaa3ba",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0342"
],
"kb_rule_ids": [
"pat-0342"
],
"matched_patterns": [
"pat-0342"
],
"matched_pattern_names": [
"ES cat indices"
],
"pattern_ids": [
"pat-0342"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6273f9be1b02ca05f8b0ec5ce5b17279",
"payload_hash": "41c51a137a758d49d18f7251f8c414fd",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 55
},
"payload_preview": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWeb",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWeb",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWeb",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "45afa4cb4d58bb49cca6558c22c33cda03b13907",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.\u2026",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWeb",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via ELASTICSEARCH",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0342"
],
"tags_summary_labels_fr": [
"pat-0342"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.\u2026",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWeb",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"net_elasticsearch_probe"
]
}
19/07/2026 04:11:25 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 203,
"payload_entropy": 5.386085014894435,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9f12d6d83c0de3e200df0a9f8df7ab2b",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 ",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.6 Safari\/605.1.15\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.6 Safari\/605.1.15\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e967b85c06285e779ad9262334d8e5aec091bed",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
19/07/2026 02:36:18 UTC
TCP
9200 · ELASTICSEARCH
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices
Élevée
Moyen · 55
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices?format=json UA Mozilla/5.0 (Android 14; Mobile; rv:135.0) Gecko/135.0 Firefox/…
Émulateur
ELASTICSEARCH
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950607:elastic-cat
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 49 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0342
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES cat indices
Ligne de requête
GET /_cat/indices?format=json HTTP/1.1
User-Agent
Mozilla/5.0 (Android 14; Mobile; rv:135.0) Gecko/135.0 Firefox/135.0
Règles WAF
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?format=json HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Mozilla/5.0 (Android 14; Mobile; rv:135.0) Gecko/135.
Requête brute (extrait)
GET /_cat/indices?format=json HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Mozilla/5.0 (Android 14; Mobile; rv:135.0) Gecko/135.0 Firefox/135.0 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "4f0b3cdcf79dea21f5502f835a1b0ad10c993453",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "370cae99942aa27e42f71117e2dde07013b646f5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 170,
"payload_entropy": 5.286642717867872,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 42366,
"country": "DE",
"dst_port": 9200,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25
},
"risk_score": 55,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "34d819fcbda94306efcad968f6c5b5f6a154c4ba",
"event_fingerprint": "215fef5602d81d0cd1ab4291d89cd82e15aaa3ba",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0342"
],
"kb_rule_ids": [
"pat-0342"
],
"matched_patterns": [
"pat-0342"
],
"matched_pattern_names": [
"ES cat indices"
],
"pattern_ids": [
"pat-0342"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1c2be664395b9965dff270c67dbe3c6",
"payload_hash": "a5cd314d1e7692114dc8206b0b1cfced",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 55
},
"payload_preview": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.0 Firefox\/135.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.0 Firefox\/135.0\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.0 Firefox\/135.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.0 Firefox\/135.0\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dcf50f6a2259cc3fd65d6020a6bd812d1f34ddfc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.0 Firefox\/135.0",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via ELASTICSEARCH",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0342"
],
"tags_summary_labels_fr": [
"pat-0342"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.0 Firefox\/135.0",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Android 14; Mobile; rv:135.0) Gecko\/135.",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"net_elasticsearch_probe"
]
}
19/07/2026 01:08:46 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTM
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 200,
"payload_entropy": 5.434110899305427,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7243690f4ebd724a6d251473a5d2920b",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "12811d56ec10c9767b05a8b32f1fef58f5d868e4",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
19/07/2026 00:06:39 UTC
TCP
9200 · ELASTICSEARCH
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices
Élevée
Moyen · 55
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices?format=json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
ELASTICSEARCH
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950607:elastic-cat
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 49 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0342
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES cat indices
Ligne de requête
GET /_cat/indices?format=json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?format=json HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /_cat/indices?format=json HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "88da84b12a904b3b33e36792a361fcbef2c81091",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "370cae99942aa27e42f71117e2dde07013b646f5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.45845907770515,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 42366,
"country": "DE",
"dst_port": 9200,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25
},
"risk_score": 55,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "34d819fcbda94306efcad968f6c5b5f6a154c4ba",
"event_fingerprint": "215fef5602d81d0cd1ab4291d89cd82e15aaa3ba",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0342"
],
"kb_rule_ids": [
"pat-0342"
],
"matched_patterns": [
"pat-0342"
],
"matched_pattern_names": [
"ES cat indices"
],
"pattern_ids": [
"pat-0342"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "51381b4b24c9f0c7c3af362c0b44513f",
"payload_hash": "e400a7cd42a0e4c7f17310e8e2fd3737",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 55
},
"payload_preview": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7af6c492262ec4d7f2817899b3e2061470c0d2da",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via ELASTICSEARCH",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0342"
],
"tags_summary_labels_fr": [
"pat-0342"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/132.0.0.0 Safari\/537.36",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"net_elasticsearch_probe"
]
}
18/07/2026 22:50:51 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 197,
"payload_entropy": 5.465564016976356,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1ab6deb93bcbbe380342b829b601f967",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, ",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8416776c0a665ab2869004243f56d774f4602816",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
18/07/2026 21:33:26 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
net_couchdb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.9,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "88ce2e41f896410db67033686b9ce9e920f7f3a6",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd15953b0b902a8f240231f4ea2815ec6be92ba5",
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"net_couchdb_probe"
]
}
18/07/2026 16:08:50 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
net_couchdb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.9,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "88ce2e41f896410db67033686b9ce9e920f7f3a6",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd15953b0b902a8f240231f4ea2815ec6be92ba5",
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"net_couchdb_probe"
]
}
18/07/2026 13:27:10 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
net_couchdb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.9,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "88ce2e41f896410db67033686b9ce9e920f7f3a6",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd15953b0b902a8f240231f4ea2815ec6be92ba5",
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"net_couchdb_probe"
]
}
18/07/2026 10:42:44 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTM
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 200,
"payload_entropy": 5.434110899305427,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7243690f4ebd724a6d251473a5d2920b",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "12811d56ec10c9767b05a8b32f1fef58f5d868e4",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/537.36 (KHTM",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
18/07/2026 08:01:13 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
net_couchdb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.9,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "88ce2e41f896410db67033686b9ce9e920f7f3a6",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd15953b0b902a8f240231f4ea2815ec6be92ba5",
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"net_couchdb_probe"
]
}
18/07/2026 05:46:27 UTC
TCP
9200 · ELASTICSEARCH
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)
Élevée
Faible · 22
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Sonde Elasticsearch (REST)
Émulateur
ELASTICSEARCH
WAF
—
Recommandation
Surveiller
Tags
elasticsearch_emulated
net_elasticsearch_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9200
Chemin / cible
—
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 22
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 42366,
"country": "DE",
"dst_port": 9200,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 22,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "6dfec99b98d53481ee9b4cf1a1a54e12b0341ca9",
"event_fingerprint": "64ce65412bf1b81fa23464b76dd480979155e3d0",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 22
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 22
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "191a0c390e0c8bb3045189c33e41a4f22e6ddf86",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 22
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 22,
"risk_label": "Faible",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"elasticsearch_emulated",
"net_elasticsearch_probe"
]
}
18/07/2026 03:38:06 UTC
TCP
5984 · COUCHDB
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K
Requête brute (extrait)
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 203,
"payload_entropy": 5.429006411555504,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 42366,
"country": "DE",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a714389d6d9067ad71ffae1e1380faa8f150387",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "63d805c7dc36f82fa5acb8d0000452ee",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c8193ee61523b1c0f177c12356c83fb19f2e97e",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
]
}
18/07/2026 02:04:56 UTC
TCP
9200 · ELASTICSEARCH
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices
Élevée
Moyen · 55
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices?format=json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100…
Émulateur
ELASTICSEARCH
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950607:elastic-cat
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 49 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0342
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES cat indices
Ligne de requête
GET /_cat/indices?format=json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0
Règles WAF
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?format=json HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) G
Requête brute (extrait)
GET /_cat/indices?format=json HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0 Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "0a7beb025826a9389913ce07c14626745e872b44",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "370cae99942aa27e42f71117e2dde07013b646f5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 182,
"payload_entropy": 5.308080372925366,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 42366,
"country": "DE",
"dst_port": 9200,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25
},
"risk_score": 55,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "34d819fcbda94306efcad968f6c5b5f6a154c4ba",
"event_fingerprint": "215fef5602d81d0cd1ab4291d89cd82e15aaa3ba",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0342"
],
"kb_rule_ids": [
"pat-0342"
],
"matched_patterns": [
"pat-0342"
],
"matched_pattern_names": [
"ES cat indices"
],
"pattern_ids": [
"pat-0342"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "831e54d58d24e1f9a7ffb238eb60c7a4",
"payload_hash": "df8a9c9264a3e25d0df8835b3a889a6a",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 55
},
"payload_preview": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) G",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko\/20100101 Firefox\/132.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko\/20100101 Firefox\/132.0\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) G",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko\/20100101 Firefox\/132.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko\/20100101 Firefox\/132.0\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) G",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0770b76df414452cd9a1af5a37ca7f0d3ff37f18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko\/20100101 Firefox\/132.0",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) G",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via ELASTICSEARCH",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0342"
],
"tags_summary_labels_fr": [
"pat-0342"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko\/20100101 Firefox\/132.0",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) G",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"net_elasticsearch_probe"
]
}