192.155.89.120

{
    "bytes_in": 78,
    "payload_entropy": 5.952068885528922,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "07542c6becaecdcdca50a371ce717331",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "payload_preview": "\t\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
    "request_sample": "\t\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
    "payload_snippet": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
    "evidence": {
        "request_sample": "\t\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
        "payload_snippet": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cddd4b3a63b324003ac1f39d838488c6b294c99c",
    "protocol_details": {
        "payload_preview": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
        "port": 9633
    },
    "evidence_snippet": ";Bo3\ufffdD\ufffd\ufffdsi=\ufffd\ufffd\ufffd\ufffd:\ufffd\u026e\ufffd<0\ufffd8\ufffd\ufffd\ufffdN\ufffd\ufffd\u07b7<oN\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\ufffdC\ufffd4]\ufffd\ufffdPVf\ufffd\ufffd\u0223+b\ufffd\ufffd",
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 15,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd",
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": ";Bo3\ufffdD\ufffd\ufffdsi=\ufffd\ufffd\ufffd\ufffd:\ufffd\u026e\ufffd<0\ufffd8\ufffd\ufffd\ufffdN\ufffd\ufffd\u07b7<oN\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd*\ufffdC\ufffd4]\ufffd\ufffdPVf\ufffd\ufffd\u0223+b\ufffd\ufffd",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:9633",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 6,
    "payload_entropy": 2.2516291673878226,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1532e76dbe9d43d0dea98c331ca5ae8a",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "payload_preview": "batman",
    "request_sample": "batman",
    "payload_snippet": "batman",
    "evidence": {
        "request_sample": "batman",
        "payload_snippet": "batman",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a7c7f274e2ff7f4b3c7ec22ddeb018fa4ff9df79",
    "protocol_details": {
        "payload_preview": "batman",
        "port": 9633
    },
    "evidence_snippet": "batman",
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "batman",
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "batman",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9633"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "cbcd1d81f242de31fd683d5acbc70dca",
    "tls_sni": "ABC-U6U673WEF",
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 8,
    "bytes_in": 121,
    "payload_entropy": 4.905270087972374,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "tls",
    "app_proto": "tls",
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1e963921cfce2153b3e9233a47ee61f794922cd5",
    "event_fingerprint": "e8cdd1c86a6af3d3c1a034e78b7b4cdc44843fc3",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "service_name": "tls",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "cbcd1d81f242de31fd683d5acbc70dca",
        "payload_hash": "f1259f03732f4007ef7053cbd91b8852",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
        "ja4": "aa2c14256328734fbc594089fa198c52",
        "tls_version": "0x0301",
        "tls_cipher_count": 12,
        "tls_sni": "ABC-U6U673WEF",
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "769,49172-49171-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0",
    "tls_ja4_hash": "aa2c14256328734fbc594089fa198c52",
    "tls_ja4": "t13d0112_b95786268cb1_d63375ab50e9",
    "tls_version": "0x0301",
    "tls_cipher_count": 12,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 9633,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1a1c3cfc57a6775275ab30bb08895cbbf4b6c8fd",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
        "tls_ja3": "cbcd1d81f242de31fd683d5acbc70dca",
        "tls_ja4": "aa2c14256328734fbc594089fa198c52",
        "tls_sni": "ABC-U6U673WEF",
        "port": 9633,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "tpYF}\ufffd3\u04e2'O\ufffd\ufffd1p\ufffdF\u59a2\ufffd}\ufffdO)u\ufffd\ufffd\ufffd\ufffd\ufffd5\/\ufffd\n\ufffd\t82\n\/\rABC-U6U673WEF\n\ufffd",
    "attack_vector": "tls probe \u00b7 via TLS:9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
            "tls_ja3": "cbcd1d81f242de31fd683d5acbc70dca",
            "tls_ja4": "aa2c14256328734fbc594089fa198c52",
            "tls_sni": "ABC-U6U673WEF",
            "port": 9633,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "tls probe \u00b7 via TLS:9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "tpYF}\ufffd3\u04e2'O\ufffd\ufffd1p\ufffdF\u59a2\ufffd}\ufffdO)u\ufffd\ufffd\ufffd\ufffd\ufffd5\/\ufffd\n\ufffd\t82\n\/\rABC-U6U673WEF\n\ufffd",
        "target_port_label": "9633 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:9633",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 144,
    "payload_entropy": 3.7524121173816725,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4c08b667ad2290ced22cda22075fd99b",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "payload_preview": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
    "request_sample": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
    "payload_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
        "payload_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3952f2448b2266fa2e03d9a0e8f16a93c2331a5a",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
        "port": 9633
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:9633",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 69,
    "payload_entropy": 5.767803079903862,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c12d37882087cf9ca03116d828e11245",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "payload_preview": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
    "request_sample": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
    "payload_snippet": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
    "evidence": {
        "request_sample": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
        "payload_snippet": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1bbb3cd9e4174dd566fddf2a2936865953c3b1b7",
    "protocol_details": {
        "payload_preview": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
        "port": 9633
    },
    "evidence_snippet": "AfH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\ufffd\ufffd\u02cf\ufffd\ufffd\ufffdJ\ufffd<\ufffd\ufffd`",
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 15,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`",
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "AfH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\ufffd\ufffd\u02cf\ufffd\ufffd\ufffdJ\ufffd<\ufffd\ufffd`",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:9633",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 117,
    "payload_entropy": 4.175258830258507,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a2d2685956f7f410604536189c003f5c",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "payload_preview": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
    "request_sample": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
    "payload_snippet": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
    "evidence": {
        "request_sample": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
        "payload_snippet": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cdbf15ec8ff3fed8fbe42a81104a2a445bc14c43",
    "protocol_details": {
        "payload_preview": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
        "port": 9633
    },
    "evidence_snippet": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|Win XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9633"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 518,
    "payload_entropy": 7.586688001255927,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0514"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3699d67b1c1d3f5e51e94c25bf3415b4",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "payload_preview": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd\r",
    "request_sample": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd\rX'\ufffd\u0005\ufffd\u0364GH\u0000\/~s;`(&)\ufffdK_\u0002\u0002\ufffd\ufffd\u0000\u0010\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000bn\ufffd\ufffd*#\ufffdL\r\ufffd\ufffd\ufffd\ufffd\u0007\ufffdsz\u001cs\ufffdW\ufffd\ufffd\b\/\ufffd\ufffd0*\ufffd\u0004~3E]\ufffdM\ufffd\u0611\b\ufffd\ufffd\u0551\ufffd\ufffd\u044c\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\"eUY\ufffdE:I2_\ufffd\ufffd\ufffd\u001c\\\ufffd~\ufffd\nc~\ufffd\ufffdrZ\ufffd\/U\ufffd\ufffdf\ufffdfi",
    "payload_snippet": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd",
    "evidence": {
        "request_sample": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd\rX'\ufffd\u0005\ufffd\u0364GH\u0000\/~s;`(&)\ufffdK_\u0002\u0002\ufffd\ufffd\u0000\u0010\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000bn\ufffd\ufffd*#\ufffdL\r\ufffd\ufffd\ufffd\ufffd\u0007\ufffdsz\u001cs\ufffdW\ufffd\ufffd\b\/\ufffd\ufffd0*\ufffd\u0004~3E]\ufffdM\ufffd\u0611\b\ufffd\ufffd\u0551\ufffd\ufffd\u044c\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\"eUY\ufffdE:I2_\ufffd\ufffd\ufffd\u001c\\\ufffd~\ufffd\nc~\ufffd\ufffdrZ\ufffd\/U\ufffd\ufffdf\ufffdfi",
        "payload_snippet": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "984c701aae1543de9b3476b76b16e9ea8cf8aadd",
    "protocol_details": {
        "payload_preview": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd",
        "port": 9633
    },
    "evidence_snippet": "\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\ufffd3*\ufffd\ufffd'\ufffd\ufffdk\ufffd\ufffd\nG\ufffdW\ufffdzOe\ufffd\ufffdaFCysA\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\ufffd\ufffd\ufffdb\ufffdvG\ufffd\/\ufffd\ufffd&o\ufffd@Jz\ufffd\ufffd3iBQ\ufffdQ\ufffd\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\ufffdZ\ufffd&e\ufffd\ufffd",
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 15,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0514"
        ],
        "tags_summary_labels_fr": [
            "pat-0514"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3*\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd",
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\ufffd3*\ufffd\ufffd'\ufffd\ufffdk\ufffd\ufffd\nG\ufffdW\ufffdzOe\ufffd\ufffdaFCysA\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd*\ufffd\ufffd\ufffd\ufffdb\ufffdvG\ufffd\/\ufffd\ufffd&o\ufffd@Jz\ufffd\ufffd3iBQ\ufffdQ\ufffd\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\ufffdZ\ufffd&e\ufffd\ufffd",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9633"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 173,
    "payload_entropy": 6.526774759278568,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ac4eb53f5e8dfbbbaca7212ed0125e98",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "payload_preview": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
    "request_sample": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT\u001f\ufffd\ufffd]\nr\u000b\u0003#\ufffd\ufffd\u0002~\u0006\ufffd\u0003+\u0018m\ufffd=\ufffdtC,C\ufffdL<<==\\\ufffd\u0019\ufffd\u0000\ufffd \u0002\u0000T\ufffd+\\",
    "payload_snippet": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
    "evidence": {
        "request_sample": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT\u001f\ufffd\ufffd]\nr\u000b\u0003#\ufffd\ufffd\u0002~\u0006\ufffd\u0003+\u0018m\ufffd=\ufffdtC,C\ufffdL<<==\\\ufffd\u0019\ufffd\u0000\ufffd \u0002\u0000T\ufffd+\\",
        "payload_snippet": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "48260422949ac8ff3492395b2594131a99a8990f",
    "protocol_details": {
        "payload_preview": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
        "port": 9633
    },
    "evidence_snippet": "Gh0st\ufffd\ufffdx\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\ufffd\ufffde&\ufffd*$&g+2\ufffd\ufffd\ufffd00\ufffd\ufffdrc\ufffd\ufffd\\`&\ufffd\ufffdK7\ufffd\ufffdn9\ufffdn;\ufffd3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd@\ufffd`T",
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 15,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd*\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT",
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "Gh0st\ufffd\ufffdx\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\ufffd\ufffde&\ufffd*$&g+2\ufffd\ufffd\ufffd00\ufffd\ufffdrc\ufffd\ufffd\\`&\ufffd\ufffdK7\ufffd\ufffdn9\ufffdn;\ufffd3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd@\ufffd`T",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9633"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 280,
    "payload_entropy": 5.4072640905205,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "88230f14a43950fa1f87f2ce9b5783a9",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "payload_preview": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
    "request_sample": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d|'|'|..|'|'|AA==|'|'|112.inf|'|'|SGFjS2VkDQoxOTIuMTY4LjkyLjIyMjo1NTUyDQpEZXNrdG9wDQpjbGllbnRhLmV4ZQ0KRmFsc2UNCkZhbHNlDQpUcnVlDQp",
    "payload_snippet": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
    "evidence": {
        "request_sample": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d|'|'|..|'|'|AA==|'|'|112.inf|'|'|SGFjS2VkDQoxOTIuMTY4LjkyLjIyMjo1NTUyDQpEZXNrdG9wDQpjbGllbnRhLmV4ZQ0KRmFsc2UNCkZhbHNlDQpUcnVlDQp",
        "payload_snippet": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9df2b70082269420fee9bceb6777fcc5402fc80b",
    "protocol_details": {
        "payload_preview": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
        "port": 9633
    },
    "evidence_snippet": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 15,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "145.ll|'|'|SGFjS2VkX0Q0OTkwNjI3|'|'|WIN-JNAPIER0859|'|'|JNapier|'|'|19-02-01|'|'||'|'|Win 7 Professional SP1 x64|'|'|No|'|'|0.7d",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9633"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 76,
    "payload_entropy": 5.800559092390959,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0356"
    ],
    "kb_rule_ids": [
        "pat-0356"
    ],
    "matched_patterns": [
        "pat-0356",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0356",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15,
        "risk_score": 32,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ce42628f54668ae436e0cba19c9ae85c",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 32
    },
    "payload_preview": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
    "request_sample": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
    "payload_snippet": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
    "evidence": {
        "request_sample": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
        "payload_snippet": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c1d4034779e906c6b2b22ad7dc87c16993838ceb",
    "protocol_details": {
        "payload_preview": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
        "port": 9633
    },
    "evidence_snippet": "Htj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u05cd\ufffd\ufffdJn\ufffd\ufffdxu[l\ufffdE-j\ufffd\ufffdxL\ufffdr\ufffdu\ufffd%\ufffdRtgfv\ufffd]%\u0300\ufffd\u03ee\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
    "attack_vector": "mssql tds \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 15,
            "risk_score": 32,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0356"
        ],
        "tags_summary_labels_fr": [
            "pat-0356"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
            "port": 9633
        },
        "attack_vector": "mssql tds \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "Htj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u05cd\ufffd\ufffdJn\ufffd\ufffdxu[l\ufffdE-j\ufffd\ufffdxL\ufffdr\ufffdu\ufffd%\ufffdRtgfv\ufffd]%\u0300\ufffd\u03ee\ufffd\ufffdf\u020dD\ufffd\t\ufffd",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9633"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 136,
    "payload_entropy": 6.556105028702606,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0577"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 15,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c06fc23d2f224f4eb425bd383053b222",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
    "request_sample": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP\u0015\ufffd\u001e\u000e\ufffd\ufffd\ufffdJ",
    "payload_snippet": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
    "evidence": {
        "request_sample": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP\u0015\ufffd\u001e\u000e\ufffd\ufffd\ufffdJ",
        "payload_snippet": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7dee56ebf4d54e1d17d6135b110b47c795a9ab09",
    "protocol_details": {
        "payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
        "port": 9633
    },
    "evidence_snippet": "\ufffd,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\ufffd3o)S}\ufffd\ufffd\ufffdb\u03b6\ufffd\ufffd7>\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc]V\ufffdV\ufffd_Tt\ufffd\ufffd\ufffdw\ufffdM=[1\ufffd\ufffd\ufffd\ufffdg^\ufffd\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\ufffd\ufffd{_LP",
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 15,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0577"
        ],
        "tags_summary_labels_fr": [
            "pat-0577"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP",
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\ufffd3o)S}\ufffd\ufffd\ufffdb\u03b6\ufffd\ufffd7>\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc]V\ufffdV\ufffd_Tt\ufffd\ufffd\ufffdw\ufffdM=[1\ufffd\ufffd\ufffd\ufffdg^\ufffd\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\ufffd\ufffd{_LP",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "http_header_count": 0,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 18,
    "payload_entropy": 3.461320140211008,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "http",
    "app_proto": "http",
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 20,
    "risk_classification": 8,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 20,
        "classification": 8,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "688dcfefc82be657a15417b507d429f69f5f7715",
    "event_fingerprint": "0b71458fd7944d081ba788902df8dea78cf8af03",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ec63b40bcbc26b71deda762dfd844f0",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9633,
        "service": "http",
        "service_name": "http",
        "risk_score": 35
    },
    "payload_preview": "GET \/ HTTP\/1.0\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.0",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.0\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.0",
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%"
    },
    "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
    "confidence_breakdown": {
        "waf": 20,
        "classification": 8,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "084f42f88483b4cfd530c08271bf05720e582879",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "port": 9633,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.0",
    "attack_vector": "http \u00b7 via HTTP:9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
        "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 8,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "port": 9633,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.0",
        "target_port_label": "9633 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9633"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 6,
    "payload_entropy": 2.584962500721156,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 56,
    "precision_signals": [
        "pat-0626"
    ],
    "kb_rule_ids": [
        "pat-0626"
    ],
    "matched_patterns": [
        "pat-0626"
    ],
    "matched_pattern_names": [
        "OPC UA HEL"
    ],
    "pattern_ids": [
        "pat-0626"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fb323af48498fcb3974ce6b1881c8797",
        "path_pattern_hash": "9665a326f7d8f70f1661dab78807b951"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 35
    },
    "payload_preview": "HELP\r\n",
    "request_sample": "HELP\r\n",
    "payload_snippet": "HELP",
    "evidence": {
        "request_sample": "HELP\r\n",
        "payload_snippet": "HELP",
        "classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dd8c4e1e14e9899781a06e1cd144a90bcbf70e0c",
    "protocol_details": {
        "payload_preview": "HELP",
        "port": 9633
    },
    "evidence_snippet": "HELP",
    "attack_vector": "opcua probe \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0626"
        ],
        "tags_summary_labels_fr": [
            "pat-0626"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "HELP",
            "port": 9633
        },
        "attack_vector": "opcua probe \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "HELP",
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9633"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": null,
    "app_proto": null,
    "asn": 63949,
    "country": "US",
    "dst_port": 9633,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2c9ded7d91a78b0939787412f3b9ef719ebebeed",
    "event_fingerprint": "06bcd843e9bc4544978899d108bbec5d406fb8b0",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9633,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "00a4fb3ceed012d97c57fe371710c74f03ebd142",
    "protocol_details": {
        "port": 9633
    },
    "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
    "target_port_label": "9633",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9633,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 9633
        },
        "attack_vector": "Sonde port \u00b7 port 9633 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9633",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9633"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 8,
    "payload_entropy": 2.4056390622295662,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "39fea238df890c005706b34a9316349a",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 34
    },
    "payload_preview": "\u0001I20100\n",
    "request_sample": "\u0001I20100\n",
    "payload_snippet": "\u0001I20100",
    "evidence": {
        "request_sample": "\u0001I20100\n",
        "payload_snippet": "\u0001I20100",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fe7ed75d7688cb844922929c1a9815ad1a0bfb5b",
    "protocol_details": {
        "payload_preview": "\u0001I20100",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "I20100",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0001I20100",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "I20100",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 211,
    "payload_entropy": 3.723542292143943,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0577"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2b2f0f60ab534853bdae51b3f2504307",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_snippet": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1",
    "evidence": {
        "request_sample": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista",
        "payload_snippet": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ef1ac9e6b75164062823d78c68374116c6ee04db",
    "protocol_details": {
        "payload_preview": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "\ufffdANY-SCPFINDSCU1.2.840.10008.3.1.1.1 .01.2.840.10008.1.1",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0577"
        ],
        "tags_summary_labels_fr": [
            "pat-0577"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdANY-SCPFINDSCU1.2.840.10008.3.1.1.1 .01.2.840.10008.1.1",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 51,
    "payload_entropy": 4.135751247023955,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f940e8c4f0189dbba4d06e6e04dd941095e7f9bc",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4c95ff23a3feaef89ab3569b251ff78d",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "98fdb13984a026ab179b1671608596fd58bb0fd8",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": ",'\ufffdCookie: mstshash=Administrator",
    "attack_vector": "rdp probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via AWS ECS AGENT",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "rdp probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": ",'\ufffdCookie: mstshash=Administrator",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner",
        "tor_exit_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 5,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0768"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8855508aade16ec573d21e6a485dfd0a",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3a0b24ed3325e1fe886d27d3b2af9fe017f71fb4",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0768"
        ],
        "tags_summary_labels_fr": [
            "pat-0768"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 2380,
    "payload_entropy": 4.684268227684846,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4e59b427ee6488faa8803fa276e99d84",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_snippet": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000",
    "evidence": {
        "request_sample": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000a\u0000t\u0000e\u0000$\u0000\/\u0000q\u0000u\u0000e\u0000u\u0000e\u0000j\u0000u\u0000m\u0000p\u0000e\u0000r\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000p\u0000o\u0000c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001b\u0002\u0000\u0000<\u0000s\u0000e\u0000:\u0000E\u0000n\u0000v\u0000e\u0000l\u0000o\u0000",
        "payload_snippet": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "baa2c22b4cc3f20b2e2f8ac0f17fe5956848cf36",
    "protocol_details": {
        "payload_preview": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "LIORL\t\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffdd `http:\/\/192.168.10.100\/msmq\/priv",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "LIORL\t\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffdd `http:\/\/192.168.10.100\/msmq\/priv",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 156,
    "payload_entropy": 1.0105311893353954,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ab337a89f397026542899f981012b540",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5707d202bc79d394156a62d148953110c599d991",
    "protocol_details": {
        "payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "\ufffd+<M\ufffd\ufffdnonebeio",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd+<M\ufffd\ufffdnonebeio",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 24,
    "payload_entropy": 1.0238995733215064,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0354"
    ],
    "kb_rule_ids": [
        "pat-0354"
    ],
    "matched_patterns": [
        "pat-0354",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SMB negotiate",
        "Mumble ping",
        "STUN binding",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0354",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b54520be3d454f6926b094aac799ac34",
        "path_pattern_hash": "b6c073dc229e6284b4cae7886c46d504"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 32
    },
    "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
    "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "86b4829eaebf918140adadac5d8b012eb9b08421",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "attack_vector": "smb probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0354"
        ],
        "tags_summary_labels_fr": [
            "pat-0354"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "smb probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 144,
    "payload_entropy": 4.322879559217196,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f940e8c4f0189dbba4d06e6e04dd941095e7f9bc",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
    "confidence": 0.46,
    "classification_confidence": 0.46,
    "precision_score": 55,
    "precision_signals": [
        "INT-TOR-exit-hint"
    ],
    "kb_rule_ids": [
        "INT-TOR-exit-hint"
    ],
    "matched_patterns": [
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "STUN binding",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 46,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c3b76b5602952ca3d678868a2a4dc525",
        "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 35
    },
    "payload_preview": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A",
    "request_sample": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000",
    "payload_snippet": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A",
    "evidence": {
        "request_sample": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000",
        "payload_snippet": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A",
        "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%"
    },
    "attack_stage": "c2",
    "mitre_tactics": [
        "TA0011"
    ],
    "mitre": "TA0011",
    "threat_family": [
        "botnet"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1827146fcde538eed8c0fdcebdf78f1a691f99c3",
    "protocol_details": {
        "payload_preview": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "\ufffd_@7InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryA",
    "attack_vector": "tor exit probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (commande & contr\u00f4le)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 46 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
        "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 46 % \u2014 via AWS ECS AGENT",
        "confidence_pct": 46,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "c2",
        "attack_stage_label": "Commande & contr\u00f4le",
        "attack_chain_stage": "command_and_control",
        "attack_chain_stage_label_fr": "Commande & contr\u00f4le",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-TOR-exit-hint"
        ],
        "tags_summary_labels_fr": [
            "Tor Exit Hint"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0011",
        "mitre_technique": "TA0011",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "tor exit probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (commande & contr\u00f4le)",
        "evidence_snippet": "\ufffd_@7InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryA",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 46 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "command_and_control",
                "label_fr": "Commande & contr\u00f4le",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "command_and_control",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner",
        "tor_exit_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 18,
    "payload_entropy": 1.2086489509530647,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0532"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "817773a4a3987fc7642ff30928d792fc",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
    "request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
    "payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
    "evidence": {
        "request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
        "payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "68445e2602ed716dd4f236fcd7fb2f65aea6a97e",
    "protocol_details": {
        "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0532"
        ],
        "tags_summary_labels_fr": [
            "pat-0532"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 48,
    "payload_entropy": 2.5723387961875535,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0605"
    ],
    "kb_rule_ids": [
        "pat-0605"
    ],
    "matched_patterns": [
        "pat-0605",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "GIOP WebSphere IIOP",
        "Mumble ping",
        "STUN binding",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0605",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a2295e3d24182f08220a2dae2c40ff1c",
        "path_pattern_hash": "a8ef247ba3612b90c1c670387b185e85"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan",
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "529cd784f1410c3501f5b512ee6a7686eb39c511",
    "protocol_details": {
        "payload_preview": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "GIOP$abcdefget",
    "attack_vector": "websphere probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0605"
        ],
        "tags_summary_labels_fr": [
            "pat-0605"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "websphere probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GIOP$abcdefget",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 16,
    "payload_entropy": 3.0306390622295662,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0768"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e522ef50a429f4fc944717d334d0c486",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aa737b7466c63cc594ed42331e9fa91cd08af8ba",
    "protocol_details": {
        "payload_preview": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "87\ufffd&\ufffd\ufffd\ufffd",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0768"
        ],
        "tags_summary_labels_fr": [
            "pat-0768"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "87\ufffd&\ufffd\ufffd\ufffd",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 7,
    "payload_entropy": 2.807354922057604,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0604"
    ],
    "kb_rule_ids": [
        "pat-0604"
    ],
    "matched_patterns": [
        "pat-0604"
    ],
    "matched_pattern_names": [
        "Java RMI JRMI"
    ],
    "pattern_ids": [
        "pat-0604"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d8c49a0f759e2102fb8fa8368049d06a",
        "path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 32
    },
    "payload_preview": "JRMI\u0000\u0002K",
    "request_sample": "JRMI\u0000\u0002K",
    "payload_snippet": "JRMI\u0000\u0002K",
    "evidence": {
        "request_sample": "JRMI\u0000\u0002K",
        "payload_snippet": "JRMI\u0000\u0002K",
        "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "94f11c978a3022741f78dbb6bde8424cc19793b0",
    "protocol_details": {
        "payload_preview": "JRMI\u0000\u0002K",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "JRMIK",
    "attack_vector": "java rmi probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0604"
        ],
        "tags_summary_labels_fr": [
            "pat-0604"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "JRMI\u0000\u0002K",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "java rmi probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "JRMIK",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 151,
    "payload_entropy": 2.9394053309596297,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0577",
        "pat-0554",
        "pat-0536",
        "pat-0623"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "RADIUS Access-Request",
        "Minecraft varint handshake",
        "TFTP RRQ",
        "WireGuard handshake"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0577",
        "pat-0554",
        "pat-0536",
        "pat-0623"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "40d2dbc3799fc4c078b732b44566c778",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 32
    },
    "payload_snippet": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000\u0000\u0000A\u0000\u0000A\u0000A\u0000\u0000A\u0000A\u0000\u0000}\u0000\u0000\u0000\ufffdm\ufffd_",
        "payload_snippet": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "00df672af34e2ff8d9e29c498e49c9e520583b1b",
    "protocol_details": {
        "payload_preview": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdMMS\ufffd\ufffd\ufffd\ufffdNSPlayer\/9...98; {AA-A-a-AAA-",
    "attack_vector": "kafka probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "kafka probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdMMS\ufffd\ufffd\ufffd\ufffdNSPlayer\/9...98; {AA-A-a-AAA-",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 89,
    "payload_entropy": 3.590885939096492,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e6ee9d885892cc379640f5aecf8397b8",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
    "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
    "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
    "evidence": {
        "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
        "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8cab18f895d8f99d248213aee3c5266f5354d5ca",
    "protocol_details": {
        "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "Z6,\ufffd :\ufffd(CONNECT_DATA=(COMMAND=version))",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "Z6,\ufffd :\ufffd(CONNECT_DATA=(COMMAND=version))",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 52,
    "payload_entropy": 3.604409845438833,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "76e3eec12032c48bbcad7893ab71523e54e5605a",
    "event_fingerprint": "b0d3fdd8f53738446ea599c55dda69e3d88716a2",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "23edc99bdfe5fe902f5ff28aa98ef130",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
    "request_sample": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a186c151565598916d143cbaa1053cfbfc632e77",
    "protocol_details": {
        "payload_preview": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "4(\ufffdUMSSQLServerH",
    "attack_vector": "mssql tds \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "mssql tds \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "4(\ufffdUMSSQLServerH",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "mssql_tds",
        "net_mssql_tds"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 11,
    "payload_entropy": 1.6729330318733675,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0348",
        "pat-0352"
    ],
    "kb_rule_ids": [
        "pat-0348",
        "pat-0352"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0352",
        "pat-0868",
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "RDP negotiation",
        "ET H.323 setup",
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0352",
        "pat-0868",
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6771a78868614c6768349c36da4591da",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4470ce398a8a39bd8f65aab33be316e411b5881f",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "rdp probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via AWS ECS AGENT",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0348",
            "pat-0352"
        ],
        "tags_summary_labels_fr": [
            "pat-0348",
            "pat-0352"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "rdp probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 23,
    "payload_entropy": 2.6081816167087406,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "947f08e762562490af13d3254ff011a6",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
    "request_sample": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
    "payload_snippet": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
    "evidence": {
        "request_sample": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
        "payload_snippet": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d18d2727ae4ecdc5c1e20e07eb1ca477f5b44753",
    "protocol_details": {
        "payload_preview": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "DmdT\ufffd\ufffd",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "DmdT\ufffd\ufffd",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 60,
    "payload_entropy": 1.3389205950315934,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 10
    },
    "risk_score": 33,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "cf83115deb0c0fa52ae4db8bd18e6e07550f2c26",
    "event_fingerprint": "b015205f7547696e8eef94fa78be166157bf55c5",
    "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "precision_score": 90,
    "precision_signals": [
        "ET-PROTO-MongoDB-Wire",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "ET-PROTO-MongoDB-Wire",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0532",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "NFS RPC mount",
        "Mumble ping",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0532",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 10,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "classification_parent": "mongodb_probe",
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 80,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f60433e5ca098d6d06ab4b829e9f35c4",
        "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 33
    },
    "payload_preview": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fe755aa7e3f7179918f90fb190770546f0e22da5",
    "protocol_details": {
        "payload_preview": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": ":\/@=\/@",
    "attack_vector": "mongodb wire protocol \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
        "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 80,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 10,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "ET-PROTO-MongoDB-Wire",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "ET-PROTO-MongoDB-Wire",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "mongodb wire protocol \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": ":\/@=\/@",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 80 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "mongodb_wire_protocol",
        "net_mongodb_wire_protocol",
        "rdp_cookie_alt"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 14,
    "payload_entropy": 2.9852281360342516,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0859"
    ],
    "kb_rule_ids": [
        "pat-0859"
    ],
    "matched_patterns": [
        "pat-0859",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "ET LDAP anon bind",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0859",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "548b3df94bdc85e8b94b0de75b5e0379",
        "path_pattern_hash": "79ba87c92cce1f6abf5b6560fb8afdba"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000",
    "request_sample": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000",
    "payload_snippet": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000",
    "evidence": {
        "request_sample": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000",
        "payload_snippet": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000",
        "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f5c2b4eddcea38246a0edae9ca4a06a68793199f",
    "protocol_details": {
        "payload_preview": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "0`\ufffd",
    "attack_vector": "ldap probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0859"
        ],
        "tags_summary_labels_fr": [
            "pat-0859"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "ldap probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "0`\ufffd",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 223,
    "payload_entropy": 5.197167462839961,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0384",
        "pat-0420",
        "pat-0535"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "SIP protocol",
        "HTTP OPTIONS method",
        "SIP OPTIONS"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0384",
        "pat-0420",
        "pat-0535"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 52
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0712a7f81d9d033f2caa8a8a90bbc4a8",
        "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 52
    },
    "payload_preview": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 ",
    "request_sample": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application\/sdp\r\n\r\n",
    "payload_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
    "evidence": {
        "request_sample": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application\/sdp\r\n\r\n",
        "payload_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "efc6f82bcf7c184c7873ff680e8284581d2256f7",
    "protocol_details": {
        "payload_preview": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
    "attack_vector": "http smuggling probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (tentative d'exploit)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via AWS ECS AGENT",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 85,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 52
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "http smuggling probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 16,
    "payload_entropy": 2.5306390622295662,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0356"
    ],
    "kb_rule_ids": [
        "pat-0356"
    ],
    "matched_patterns": [
        "pat-0356",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0356",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4128f0bf8d86360e67d6f2d54987a8fb",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 32
    },
    "payload_preview": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000",
    "request_sample": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000",
    "payload_snippet": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000",
    "evidence": {
        "request_sample": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000",
        "payload_snippet": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e2b7522875ab05155642051f8fffe9443e8f50da",
    "protocol_details": {
        "payload_preview": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "TNMPTNME",
    "attack_vector": "mssql tds \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0356"
        ],
        "tags_summary_labels_fr": [
            "pat-0356"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "mssql tds \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "TNMPTNME",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 9,
    "payload_entropy": 3.169925001442312,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0577"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "39b37e76df338b7381ea8bb116701c98",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "\u0001default\n",
    "request_sample": "\u0001default\n",
    "payload_snippet": "\u0001default",
    "evidence": {
        "request_sample": "\u0001default\n",
        "payload_snippet": "\u0001default",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3c6a52c3411f9f1fb717c9e5e731a0b63ce48b3b",
    "protocol_details": {
        "payload_preview": "\u0001default",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "default",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0577"
        ],
        "tags_summary_labels_fr": [
            "pat-0577"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0001default",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "default",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 51,
    "payload_entropy": 3.7946877264252636,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0768"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "edc124f1d34ba290330abcac2736b204",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
    "request_sample": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
    "payload_snippet": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
        "payload_snippet": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f1d037d783f600cc6af962e9f8543e128f983c1e",
    "protocol_details": {
        "payload_preview": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "0\ufffd-c\ufffd$\n\nd\ufffdobjectClass0\ufffd",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0768"
        ],
        "tags_summary_labels_fr": [
            "pat-0768"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "0\ufffd-c\ufffd$\n\nd\ufffdobjectClass0\ufffd",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 168,
    "payload_entropy": 4.517824025292926,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4c8b954e7bc1bc076c8d1bd64820e67f",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.",
    "request_sample": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002Samba\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000",
    "payload_snippet": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002Samba\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000",
        "payload_snippet": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4631814ec3a21e339cdf66a17740a05f83d2ce2c",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "\ufffd\ufffdSMBr@@\ufffdPC NETWORK PROGRAM 1.0MICROSOFT NETWORKS 1.03MICROSOFT NETWORKS 3.0LANMAN1.0LM1.",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdSMBr@@\ufffdPC NETWORK PROGRAM 1.0MICROSOFT NETWORKS 1.03MICROSOFT NETWORKS 3.0LANMAN1.0LM1.",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0768"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "02d4a96a2d2e5f1c24c21fc4cbd83358cd093591",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "l",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0768"
        ],
        "tags_summary_labels_fr": [
            "pat-0768"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "l",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 53,
    "payload_entropy": 4.704058897836964,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 34,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d963b66fdf110d8684288a0719699a07d856b50c",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "08bd34a37b11f5c307f84418e0c2a579",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 34
    },
    "payload_preview": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0\r\n\r\n",
    "request_sample": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0\r\n\r\n",
    "payload_snippet": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0",
    "evidence": {
        "request_sample": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0\r\n\r\n",
        "payload_snippet": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f117ad4d61520beffcdfd63b0c8574ae3de654a4",
    "protocol_details": {
        "payload_preview": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "http_get_probe",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 42,
    "payload_entropy": 3.9511430177077895,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "daf7ed9941f61ac36c18c46b936b1ada",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f35f90fb6b6953c5774c3ec07152257983b51bac",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "*%\ufffdCookie: mstshash=beio",
    "attack_vector": "rdp probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via AWS ECS AGENT",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "rdp probe \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*%\ufffdCookie: mstshash=beio",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 110,
    "payload_entropy": 4.269606220838881,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 41,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "647c00d5d24c857ac83fe9bc2d3b005a0e4c7e82",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_reason": "Type \u00ab port_4567_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 41
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4ad5dce8143f2bcf1242885cff6e93f8",
        "path_pattern_hash": "f864580abc1c51fefa22b7b9a4b84104",
        "ja3": "16ee84a07b55074cb2751329bf1c8811",
        "ja4": "011b865e5f91ae5e1836c88110724dcb",
        "tls_version": "0x0303",
        "tls_cipher_count": 6,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "16ee84a07b55074cb2751329bf1c8811",
    "tls_ja3": "771,47-10-19-57-4-255,13,,",
    "tls_ja4_hash": "011b865e5f91ae5e1836c88110724dcb",
    "tls_ja4": "t13d0106_3fdba35f04dc_d03502c43d74",
    "tls_version": "0x0303",
    "tls_cipher_count": 6,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 41
    },
    "payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
    "evidence": {
        "request_sample": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
        "payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
        "classification_reason": "Type \u00ab port_4567_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f9b884c0cc715b31a8e6c17dbf234a89dddd1b8c",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
        "tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
        "tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
    "attack_vector": "port 4567 tcp \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_4567_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_4567_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 41
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 41,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
            "tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
            "tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "port 4567 tcp \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 117,
    "payload_entropy": 5.017384795565958,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "cadb0423aaf435668f733a341f057883",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002",
    "request_sample": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002",
    "payload_snippet": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002",
        "payload_snippet": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "69670b894c83cf50b8064360bc5563a57a554165",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "evidence_snippet": "qj\ufffdn0\ufffdk\ufffd\ufffd\n\ufffd\ufffd^0\\\ufffdP\ufffd\ufffdNM\ufffd0\ufffd\ufffd0krbtgtNM\ufffd19700101000000Z\ufffd\ufffd\u06680",
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "qj\ufffdn0\ufffdk\ufffd\ufffd\n\ufffd\ufffd^0\\\ufffdP\ufffd\ufffdNM\ufffd0\ufffd\ufffd0krbtgtNM\ufffd19700101000000Z\ufffd\ufffd\u06680",
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f74206177735f6563735f6167656e7420726561647920706f72743d343536370d0a",
    "emulator_response_len": 44,
    "bytes_in": 14,
    "payload_entropy": 0.7345299214394703,
    "port_category": "registered",
    "org": "Akamai Connected Cloud",
    "service": "aws-ecs-agent",
    "app_proto": "aws-ecs-agent",
    "asn": 63949,
    "country": "US",
    "dst_port": 4567,
    "risk_waf": 8,
    "risk_classification": 45,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "816265fc6d5545b4e2bffcaad02834271bfff300",
    "event_fingerprint": "ed5db39ce4a1ce0fda50382d1438797185e5f337",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0768"
    ],
    "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 45,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "aws-ecs-agent",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 63949,
        "org": "Akamai Connected Cloud",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4e22f28763980c307f0449194c0e0a42",
        "path_pattern_hash": "d7b9b7079445a015d8a6ef804f129303"
    },
    "target_context": {
        "dst_port": 4567,
        "service": "aws-ecs-agent",
        "service_name": "aws-ecs-agent",
        "risk_score": 45
    },
    "payload_preview": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "disclosed_scanner",
        "cloud_metadata_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d4a5dce6b962c80bc1068e62f326a6c845a751d1",
    "protocol_details": {
        "payload_preview": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 4567,
        "service": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT"
    },
    "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
    "target_port_label": "4567 \u00b7 AWS ECS AGENT",
    "emulator_service": "aws-ecs-agent",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab cloud_scanner \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 45,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "aws-ecs-agent",
        "service_label_fr": "AWS ECS AGENT",
        "dst_port": 4567,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0768"
        ],
        "tags_summary_labels_fr": [
            "pat-0768"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-aws-ecs-agent",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 4567,
            "service": "aws-ecs-agent",
            "service_label_fr": "AWS ECS AGENT"
        },
        "attack_vector": "cloud scanner \u00b7 via AWS ECS AGENT:4567 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4567 \u00b7 AWS ECS AGENT",
        "emulator_service": "aws-ecs-agent",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "aws_ecs_agent",
        "service_banner": "honeypot-aws-ecs-agent",
        "service_os": "linux",
        "dst_port": "4567"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "aws_ecs_agent_emulated",
        "aws_ecs_agent_payload",
        "net_cloud_scanner"
    ],
    "asn_dc_heuristic": true
}