{"ip":"192.53.123.202","exported_at":"2026-07-19T18:20:05+00:00","period_days":7,"metrics":{"events7d":10,"distinct_ports":1,"distinct_classifications":1,"max_severity":4,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":35,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["scanner"],"recommended_action":"monitor","confidence":0.5,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":10,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 35\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15,"risk_score":35},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":50,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0554"],"tags_summary":["pat-0554"],"attack_vector":"tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\u001c\u001bW5\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0027\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000\u003C\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005","tls_ja3":"45ce27f47e0f147e54ede25a4b0553fd","tls_sni":"62.3.50.33","port":992,"service":"tls","service_label_fr":"TLS"},"protocol_summary_fr":"JA3 45ce27f47e0f147e \u00b7 SNI 62.3.50.33 \u00b7 Payload \u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\u001c\u001bW5\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\u2026 \u00b7 TLS:992","evidence_snippet":"\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\ufffd\ufffdE\ufffd\ufffd|9\ufffd jW5lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5","target_port_label":"992 \u00b7 TLS","emulator_service":"tls","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 50 % \u2014 Score WAF 8","payload_preview":"\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\ufffd\ufffdE\ufffd\ufffd|9\ufffd jW5lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\n\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5"},"events":[{"id":12793389,"ip":"192.53.123.202","ts":"2026-07-18 17:33:20.000000","proto":"tcp","src_port":46964,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 426, \u0022payload_entropy\u0022: 6.0160486279855165, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u00221ee6b107c802b7de6ce3c2d26aba557b14eca19d\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022payload_hash\u0022: \u0022409dd1fb6accfbde07b91341a03dba77\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\\u001eR\ufffd\\r\\u000f\ufffd\ufffd\ufffd\\u0016\ufffdu\ufffdRV\ufffd\\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\\u0002\ufffd\\t\ufffd\ufffd\ufffd\\b\ufffd2\ufffdR\\nWY\ufffd\\u000e\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\\u001eR\ufffd\\r\\u000f\ufffd\ufffd\ufffd\\u0016\ufffdu\ufffdRV\ufffd\\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\\u0002\ufffd\\t\ufffd\ufffd\ufffd\\b\ufffd2\ufffdR\\nWY\ufffd\\u000e\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\\u0014\ufffd\/\ufffd\u0027\ufffd\\u0013\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\\u001eR\ufffd\\r\\u000f\ufffd\ufffd\ufffd\\u0016\ufffdu\ufffdRV\ufffd\\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\\u0002\ufffd\\t\ufffd\ufffd\ufffd\\b\ufffd2\ufffdR\\nWY\ufffd\\u000e\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022586d93fc5898d8f9a7462db28737057e54d76b03\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\\u001eR\ufffd\\r\\u000f\ufffd\ufffd\ufffd\\u0016\ufffdu\ufffdRV\ufffd\\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\\u0002\ufffd\\t\ufffd\ufffd\ufffd\\b\ufffd2\ufffdR\\nWY\ufffd\\u000e\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022tls_ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdip\ufffdn\ufffd\ufffd\ufffd\ufffdsUxR\ufffd\\r\ufffd\ufffd\ufffd\ufffdu\ufffdRV\ufffd\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\ufffd\\t\ufffd\ufffd\ufffd\ufffd2\ufffdR\\nWY\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003ip\ufffdn\ufffd\ufffd\ufffd\ufffdsUx\\u001eR\ufffd\\r\\u000f\ufffd\ufffd\ufffd\\u0016\ufffdu\ufffdRV\ufffd\\u0002\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\\u0002\ufffd\\t\ufffd\ufffd\ufffd\\b\ufffd2\ufffdR\\nWY\ufffd\\u000e\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022tls_ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdip\ufffdn\ufffd\ufffd\ufffd\ufffdsUxR\ufffd\\r\ufffd\ufffd\ufffd\ufffdu\ufffdRV\ufffd\u81ba\ufffd\ufffd \ufffdw(\ufffd\u079aaogG\u0597TSCM\ufffd\\t\ufffd\ufffd\ufffd\ufffd2\ufffdR\\nWY\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"013c30c8ce44c8b27e9ceb2a14db7283","tls_ja3":"771,5-4-7-192-132-186-65-157-49313-49309-61-53-156-49312-49308-60-47-10-49169-52243-4867-4868-4869-52392-49271-49270-49249-49248-49200-49192-49172-49199-49191-49171-49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":426},{"id":12793390,"ip":"192.53.123.202","ts":"2026-07-18 17:33:20.000000","proto":"tcp","src_port":46974,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022917fde1bf3bcb67f961b77b18d9ee14a\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 416, \u0022payload_entropy\u0022: 5.9935032025692925, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u002252cc6850fb7978546653ec286dc22ef0b09d07a0\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022917fde1bf3bcb67f961b77b18d9ee14a\u0022, \u0022payload_hash\u0022: \u00221cd16e6f4da64015fc8dec4240bde073\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003%\u0590(\\u0007\ufffd\ufffd\ufffd\ufffd?e\\r\ufffd2\ufffd\ufffda\u013b\\b\\u001dK\ufffd\ufffd\ufffdc\ufffdqK\\u001a \\u0012|B\\u001f\ufffd6\\f*\ufffd;6\ufffd\ufffdO\\u0019\\u0004g\ufffd4\\r\ufffd\\u0001uD!Kq\ufffdL?\u003E\\\u0022\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003%\u0590(\\u0007\ufffd\ufffd\ufffd\ufffd?e\\r\ufffd2\ufffd\ufffda\u013b\\b\\u001dK\ufffd\ufffd\ufffdc\ufffdqK\\u001a \\u0012|B\\u001f\ufffd6\\f*\ufffd;6\ufffd\ufffdO\\u0019\\u0004g\ufffd4\\r\ufffd\\u0001uD!Kq\ufffdL?\u003E\\\u0022\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003%\u0590(\\u0007\ufffd\ufffd\ufffd\ufffd?e\\r\ufffd2\ufffd\ufffda\u013b\\b\\u001dK\ufffd\ufffd\ufffdc\ufffdqK\\u001a \\u0012|B\\u001f\ufffd6\\f*\ufffd;6\ufffd\ufffdO\\u0019\\u0004g\ufffd4\\r\ufffd\\u0001uD!Kq\ufffdL?\u003E\\\u0022\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fcdd1096ab6540fda4cac9241dcad74eca71ecc8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003%\u0590(\\u0007\ufffd\ufffd\ufffd\ufffd?e\\r\ufffd2\ufffd\ufffda\u013b\\b\\u001dK\ufffd\ufffd\ufffdc\ufffdqK\\u001a \\u0012|B\\u001f\ufffd6\\f*\ufffd;6\ufffd\ufffdO\\u0019\\u0004g\ufffd4\\r\ufffd\\u0001uD!Kq\ufffdL?\u003E\\\u0022\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022917fde1bf3bcb67f961b77b18d9ee14a\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd%\u0590(\ufffd\ufffd\ufffd\ufffd?e\\r\ufffd2\ufffd\ufffda\u013bK\ufffd\ufffd\ufffdc\ufffdqK |B\ufffd6*\ufffd;6\ufffd\ufffdOg\ufffd4\\r\ufffduD!Kq\ufffdL?\u003E\\\u0022\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003%\u0590(\\u0007\ufffd\ufffd\ufffd\ufffd?e\\r\ufffd2\ufffd\ufffda\u013b\\b\\u001dK\ufffd\ufffd\ufffdc\ufffdqK\\u001a \\u0012|B\\u001f\ufffd6\\f*\ufffd;6\ufffd\ufffdO\\u0019\\u0004g\ufffd4\\r\ufffd\\u0001uD!Kq\ufffdL?\u003E\\\u0022\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022917fde1bf3bcb67f961b77b18d9ee14a\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd%\u0590(\ufffd\ufffd\ufffd\ufffd?e\\r\ufffd2\ufffd\ufffda\u013bK\ufffd\ufffd\ufffdc\ufffdqK |B\ufffd6*\ufffd;6\ufffd\ufffdOg\ufffd4\\r\ufffduD!Kq\ufffdL?\u003E\\\u0022\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"917fde1bf3bcb67f961b77b18d9ee14a","tls_ja3":"771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":416},{"id":12793392,"ip":"192.53.123.202","ts":"2026-07-18 17:33:20.000000","proto":"tcp","src_port":46990,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002245ce27f47e0f147e54ede25a4b0553fd\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 439, \u0022payload_entropy\u0022: 6.052247549523526, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u00225d276096f366a988cacd7c5112548d8958fd1049\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002245ce27f47e0f147e54ede25a4b0553fd\u0022, \u0022payload_hash\u0022: \u0022e4f084863ae6e002ff587243070e4445\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\\u001c\\u001bW5\\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\\n\\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\\u001c\\u001bW5\\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\\n\\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\\u001c\\u001bW5\\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\\n\\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223718fbcbb69f1dcc289e87f20e35cdd720f8e7b7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\\u001c\\u001bW5\\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\\n\\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\u0022, \u0022tls_ja3\u0022: \u002245ce27f47e0f147e54ede25a4b0553fd\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\ufffd\ufffdE\ufffd\ufffd|9\ufffd jW5lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\\n\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\\u0012\ufffd\ufffdE\ufffd\ufffd|9\ufffd j\\u001c\\u001bW5\\u0001lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\\n\\u000f\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\u0022, \u0022tls_ja3\u0022: \u002245ce27f47e0f147e54ede25a4b0553fd\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffdMWe\ufffd\ufffd]\/]\ufffd1\u0289?\ufffd\ufffd%I\ufffd\ufffdE\ufffd\ufffd|9\ufffd jW5lm\ufffd*\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\ufffd\ufffdn\\n\ufffdgQ\ufffd\ufffd\ufffd2\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"45ce27f47e0f147e54ede25a4b0553fd","tls_ja3":"771,39578-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,51914-0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":439},{"id":12793384,"ip":"192.53.123.202","ts":"2026-07-18 17:33:19.000000","proto":"tcp","src_port":46904,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002203a3ad27040f733ee5c9915e0903d028\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 9, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 345, \u0022payload_entropy\u0022: 6.0456487669258765, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u00222d4f6250da93227e78d9b8d165e24bcfdd5b0bba\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002203a3ad27040f733ee5c9915e0903d028\u0022, \u0022payload_hash\u0022: \u00222d6c2f2e7f4842da4e76916e3c6aab57\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003Z\ufffd\ufffd\ufffd~\\u0004\\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\\u0000\ufffd\ufffd\u02b3\\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\\u0016\ufffd\ufffd\\r\ufffdI\ufffd)\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003Z\ufffd\ufffd\ufffd~\\u0004\\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\\u0000\ufffd\ufffd\u02b3\\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\\u0016\ufffd\ufffd\\r\ufffdI\ufffd)\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\u003C\\u0000:\\bhttp\/0.9\\bhttp\/1.0\\bhttp\/1.1\\u0006spdy\/1\\u0006spdy\/2\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003Z\ufffd\ufffd\ufffd~\\u0004\\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\\u0000\ufffd\ufffd\u02b3\\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\\u0016\ufffd\ufffd\\r\ufffdI\ufffd)\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226bc96f2889c1e85f351a5eea42e1a2d6c8189023\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003Z\ufffd\ufffd\ufffd~\\u0004\\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\\u0000\ufffd\ufffd\u02b3\\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\\u0016\ufffd\ufffd\\r\ufffdI\ufffd)\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022tls_ja3\u0022: \u002203a3ad27040f733ee5c9915e0903d028\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022TPZ\ufffd\ufffd\ufffd~\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\ufffd\ufffd\u02b3\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\ufffd\ufffd\\r\ufffdI\ufffd)F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003Z\ufffd\ufffd\ufffd~\\u0004\\u001a\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\\u0000\ufffd\ufffd\u02b3\\u0002\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\\u0016\ufffd\ufffd\\r\ufffdI\ufffd)\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022tls_ja3\u0022: \u002203a3ad27040f733ee5c9915e0903d028\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022TPZ\ufffd\ufffd\ufffd~\ufffdH,\ufffd~\ufffd\ufffd\ufffd-f\ufffd\ufffd\ufffd\uc2e6\ufffdC0x\ufffdI|M\ufffd \ufffd(\ufffd\ufffd|\ufffd\ufffd\ufffd\u02b3\ufffd\ufffdu1\ufffd\ufffd\ufffd$\ufffdD\ufffd\ufffd\ufffd\ufffd\\r\ufffdI\ufffd)F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"03a3ad27040f733ee5c9915e0903d028","tls_ja3":"771,49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":345},{"id":12793385,"ip":"192.53.123.202","ts":"2026-07-18 17:33:19.000000","proto":"tcp","src_port":46920,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022a96dc3876784813c57d302241e620acd\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 11, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 331, \u0022payload_entropy\u0022: 5.961672617475028, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u002202cf4e4f6dadc37adcda17d6845139e5524e71e8\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022a96dc3876784813c57d302241e620acd\u0022, \u0022payload_hash\u0022: \u00220d910ccbaa6adb7005e20732d89824e9\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\\u001fj\ufffd \ufffd.\\u001ee\ufffd\ufffd\u0027\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\\f*\ufffd2\ufffdB\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\\u001fj\ufffd \ufffd.\\u001ee\ufffd\ufffd\u0027\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\\f*\ufffd2\ufffdB\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u00000\\u0000.\\bhttp\/0.9\\bhttp\/1.0\\u0006spdy\/1\\u0006spdy\/2\\u0006spdy\/3\\u0003h2c\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\\u001fj\ufffd \ufffd.\\u001ee\ufffd\ufffd\u0027\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\\f*\ufffd2\ufffdB\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220a73727ff69c99f6d9607028c3f5cb16f1e7a440\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\\u001fj\ufffd \ufffd.\\u001ee\ufffd\ufffd\u0027\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\\f*\ufffd2\ufffdB\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022a96dc3876784813c57d302241e620acd\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022FB\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffdj\ufffd \ufffd.e\ufffd\ufffd\u0027\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd2\ufffdB\ufffdD\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffd\\u001fj\ufffd \ufffd.\\u001ee\ufffd\ufffd\u0027\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\\f*\ufffd2\ufffdB\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022a96dc3876784813c57d302241e620acd\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022FB\ufffdq\ufffdN\ufffd\ufffd4\ufffdtL\ufffd\ufffd\ufffd\ufffd\ufffd}2 \ufffd\ufffd\ufffdc\ufffd3\ufffd\ufffd\ufffd\ufffdj\ufffd \ufffd.e\ufffd\ufffd\u0027\ufffd5h\ufffdx\ufffdp\ufffd}\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd2\ufffdB\ufffdD\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"a96dc3876784813c57d302241e620acd","tls_ja3":"771,49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":331},{"id":12793386,"ip":"192.53.123.202","ts":"2026-07-18 17:33:19.000000","proto":"tcp","src_port":46928,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00224333f94fe0ad43e0ba73e398e869a517\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022hq\u0022, \u0022h2c\u0022, \u0022spdy\/3\u0022, \u0022spdy\/2\u0022, \u0022spdy\/1\u0022, \u0022http\/1.0\u0022, \u0022http\/0.9\u0022], \u0022bytes_in\u0022: 412, \u0022payload_entropy\u0022: 6.006280478298539, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u0022eaa02b00673b0c0397e3ec1b719213543af6b211\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00224333f94fe0ad43e0ba73e398e869a517\u0022, \u0022payload_hash\u0022: \u0022b8fa01595040b6b97a7d6f9bc9eefd61\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u06fb\ufffd\\u0005\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\\\ufffd\ufffdO!\\u0011\\u0005 H\ufffd\ufffdW\u003C?B\ufffdn\\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\\r\ufffd\/\ufffd\ufffdtA\ufffdN\\u001b\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u06fb\ufffd\\u0005\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\\\ufffd\ufffdO!\\u0011\\u0005 H\ufffd\ufffdW\u003C?B\ufffdn\\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\\r\ufffd\/\ufffd\ufffdtA\ufffdN\\u001b\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u06fb\ufffd\\u0005\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\\\ufffd\ufffdO!\\u0011\\u0005 H\ufffd\ufffdW\u003C?B\ufffdn\\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\\r\ufffd\/\ufffd\ufffdtA\ufffdN\\u001b\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223c0720209568f0080fd2ed1985bfbca30c92bced\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u06fb\ufffd\\u0005\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\\\ufffd\ufffdO!\\u0011\\u0005 H\ufffd\ufffdW\u003C?B\ufffdn\\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\\r\ufffd\/\ufffd\ufffdtA\ufffdN\\u001b\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\u0022, \u0022tls_ja3\u0022: \u00224333f94fe0ad43e0ba73e398e869a517\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\u06fb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\\\ufffd\ufffdO! H\ufffd\ufffdW\u003C?B\ufffdn\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\\r\ufffd\/\ufffd\ufffdtA\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u06fb\ufffd\\u0005\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\\\ufffd\ufffdO!\\u0011\\u0005 H\ufffd\ufffdW\u003C?B\ufffdn\\u0005\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\\r\ufffd\/\ufffd\ufffdtA\ufffdN\\u001b\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\u0022, \u0022tls_ja3\u0022: \u00224333f94fe0ad43e0ba73e398e869a517\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\u06fb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd*\ufffd\ufffd\ufffd\ufffdXw\ufffd\ufffd\ufffd\\\\\ufffd\ufffdO! H\ufffd\ufffdW\u003C?B\ufffdn\ufffd(\ufffd\ufffdF\ufffdG\ufffd\ufffde2L\\r\ufffd\/\ufffd\ufffdtA\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"4333f94fe0ad43e0ba73e398e869a517","tls_ja3":"771,35466-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,51914-0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":412},{"id":12793387,"ip":"192.53.123.202","ts":"2026-07-18 17:33:19.000000","proto":"tcp","src_port":46938,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022006315b3ad276906ff11527f9594e5ba\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 413, \u0022payload_entropy\u0022: 5.986393355343536, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u0022f62e5863e5d6153e0cd71510048ed155760e6a2a\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022006315b3ad276906ff11527f9594e5ba\u0022, \u0022payload_hash\u0022: \u0022d205e2b71c96f29c366529938b5e73ab\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\u003C8\\u0017\ufffd\ufffd\\\u0022\ufffd\ufffd0gK\ufffdW\\n\u04f1}{R\ufffd\u003E\\u001e\ufffd\\u0014E\\u0005\ufffd\ufffd!\\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\\u0014{\u01b2\ufffd\\n\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\\u0000\\u0002\ufffd\ufffd\ufffdq\ufffd\u0026\ufffd\u0788\\t\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\u003C8\\u0017\ufffd\ufffd\\\u0022\ufffd\ufffd0gK\ufffdW\\n\u04f1}{R\ufffd\u003E\\u001e\ufffd\\u0014E\\u0005\ufffd\ufffd!\\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\\u0014{\u01b2\ufffd\\n\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\\u0000\\u0002\ufffd\ufffd\ufffdq\ufffd\u0026\ufffd\u0788\\t\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\u003C8\\u0017\ufffd\ufffd\\\u0022\ufffd\ufffd0gK\ufffdW\\n\u04f1}{R\ufffd\u003E\\u001e\ufffd\\u0014E\\u0005\ufffd\ufffd!\\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\\u0014{\u01b2\ufffd\\n\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\\u0000\\u0002\ufffd\ufffd\ufffdq\ufffd\u0026\ufffd\u0788\\t\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bc4641124f47d76e2c2c211513c33c0b2eeacb93\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\u003C8\\u0017\ufffd\ufffd\\\u0022\ufffd\ufffd0gK\ufffdW\\n\u04f1}{R\ufffd\u003E\\u001e\ufffd\\u0014E\\u0005\ufffd\ufffd!\\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\\u0014{\u01b2\ufffd\\n\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\\u0000\\u0002\ufffd\ufffd\ufffdq\ufffd\u0026\ufffd\u0788\\t\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022006315b3ad276906ff11527f9594e5ba\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u003C8\ufffd\ufffd\\\u0022\ufffd\ufffd0gK\ufffdW\\n\u04f1}{R\ufffd\u003E\ufffdE\ufffd\ufffd!\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd{\u01b2\ufffd\\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\u0026\ufffd\u0788\\t\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\u003C8\\u0017\ufffd\ufffd\\\u0022\ufffd\ufffd0gK\ufffdW\\n\u04f1}{R\ufffd\u003E\\u001e\ufffd\\u0014E\\u0005\ufffd\ufffd!\\u0011\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd\\u0014{\u01b2\ufffd\\n\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\\u0000\\u0002\ufffd\ufffd\ufffdq\ufffd\u0026\ufffd\u0788\\t\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022006315b3ad276906ff11527f9594e5ba\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u003C8\ufffd\ufffd\\\u0022\ufffd\ufffd0gK\ufffdW\\n\u04f1}{R\ufffd\u003E\ufffdE\ufffd\ufffd!\ufffd\ufffd A\ufffd\ufffdz\ufffds\ufffd{\u01b2\ufffd\\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\u0026\ufffd\u0788\\t\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"006315b3ad276906ff11527f9594e5ba","tls_ja3":"770,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":413},{"id":12793388,"ip":"192.53.123.202","ts":"2026-07-18 17:33:19.000000","proto":"tcp","src_port":46948,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 426, \u0022payload_entropy\u0022: 5.91610690677172, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u00223a3719ba6eace904aeb0318424c3bef62cfd24f7\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022payload_hash\u0022: \u0022da2918abd50d009c76aeacf56bd89da4\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\\t\ufffdq#zc\\u001c\ufffd\u014b\\\\\\u0006~; \\u0011\ufffd\ufffd\\u0000S\ufffd\ufffd\ufffd\\u0013?\ufffd\ufffd\ufffd\\n\ufffdC\ufffd\\u0011\ufffd\ufffd\ufffd\ufffd\\u0011\\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\\t\ufffdq#zc\\u001c\ufffd\u014b\\\\\\u0006~; \\u0011\ufffd\ufffd\\u0000S\ufffd\ufffd\ufffd\\u0013?\ufffd\ufffd\ufffd\\n\ufffdC\ufffd\\u0011\ufffd\ufffd\ufffd\ufffd\\u0011\\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\\t\ufffdq#zc\\u001c\ufffd\u014b\\\\\\u0006~; \\u0011\ufffd\ufffd\\u0000S\ufffd\ufffd\ufffd\\u0013?\ufffd\ufffd\ufffd\\n\ufffdC\ufffd\\u0011\ufffd\ufffd\ufffd\ufffd\\u0011\\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229a3bad4dad3202a4096aea478103d4fabef3bd9b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\\t\ufffdq#zc\\u001c\ufffd\u014b\\\\\\u0006~; \\u0011\ufffd\ufffd\\u0000S\ufffd\ufffd\ufffd\\u0013?\ufffd\ufffd\ufffd\\n\ufffdC\ufffd\\u0011\ufffd\ufffd\ufffd\ufffd\\u0011\\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\\t\ufffdq#zc\ufffd\u014b\\\\~; \ufffd\ufffdS\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\\n\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\udbb3\ude3b\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\\t\ufffdq#zc\\u001c\ufffd\u014b\\\\\\u0006~; \\u0011\ufffd\ufffd\\u0000S\ufffd\ufffd\ufffd\\u0013?\ufffd\ufffd\ufffd\\n\ufffdC\ufffd\\u0011\ufffd\ufffd\ufffd\ufffd\\u0011\\u0016B\ufffd\ufffd\udbb3\ude3b\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdr\ufffdNd)\ufffd\ufffdA\ufffd\ufffd[y\ufffd\ufffdA\ufffd\ufffd\\t\ufffdq#zc\ufffd\u014b\\\\~; \ufffd\ufffdS\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\\n\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\udbb3\ude3b\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"db8d4ad49cb378fa370b43a61a9b06b6","tls_ja3":"771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":426},{"id":12793382,"ip":"192.53.123.202","ts":"2026-07-18 17:33:18.000000","proto":"tcp","src_port":46898,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 424, \u0022payload_entropy\u0022: 6.021621769766911, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u00223a3719ba6eace904aeb0318424c3bef62cfd24f7\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022payload_hash\u0022: \u0022e1f390fc8437390bb28c676d41fa958c\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003g\\u0013Hn\ufffd\\u0017\\u0017yM\u003E%\\u001b\ufffd\ufffd\ufffdQ \ufffdz\\r\\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\\u0005\ufffd\\u001eY\\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\\r\ufffd\ufffd}\ufffd~\\u000b\ufffd\u0027\\u0019F\\u0016\\u0015\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003g\\u0013Hn\ufffd\\u0017\\u0017yM\u003E%\\u001b\ufffd\ufffd\ufffdQ \ufffdz\\r\\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\\u0005\ufffd\\u001eY\\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\\r\ufffd\ufffd}\ufffd~\\u000b\ufffd\u0027\\u0019F\\u0016\\u0015\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003g\\u0013Hn\ufffd\\u0017\\u0017yM\u003E%\\u001b\ufffd\ufffd\ufffdQ \ufffdz\\r\\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\\u0005\ufffd\\u001eY\\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\\r\ufffd\ufffd}\ufffd~\\u000b\ufffd\u0027\\u0019F\\u0016\\u0015\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224ed68bf7b8c6ce9efc7207e5fbb4e1b285b4f704\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003g\\u0013Hn\ufffd\\u0017\\u0017yM\u003E%\\u001b\ufffd\ufffd\ufffdQ \ufffdz\\r\\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\\u0005\ufffd\\u001eY\\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\\r\ufffd\ufffd}\ufffd~\\u000b\ufffd\u0027\\u0019F\\u0016\\u0015\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdgHn\ufffdyM\u003E%\ufffd\ufffd\ufffdQ \ufffdz\\rg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\ufffdY\\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\\r\ufffd\ufffd}\ufffd~\ufffd\u0027F\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003g\\u0013Hn\ufffd\\u0017\\u0017yM\u003E%\\u001b\ufffd\ufffd\ufffdQ \ufffdz\\r\\u000eg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\\u0005\ufffd\\u001eY\\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\\r\ufffd\ufffd}\ufffd~\\u000b\ufffd\u0027\\u0019F\\u0016\\u0015\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022db8d4ad49cb378fa370b43a61a9b06b6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdgHn\ufffdyM\u003E%\ufffd\ufffd\ufffdQ \ufffdz\\rg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e7 \ufffd\ufffdU}\ufffdY\\n\ufffd\ufffd\ufffd\u01a5\ufffdcF\ufffd\\r\ufffd\ufffd}\ufffd~\ufffd\u0027F\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"db8d4ad49cb378fa370b43a61a9b06b6","tls_ja3":"771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":424},{"id":12793383,"ip":"192.53.123.202","ts":"2026-07-18 17:33:18.000000","proto":"tcp","src_port":46900,"dst_port":992,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 20, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022http\/1.1\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022h2\u0022, \u0022h2c\u0022, \u0022hq\u0022], \u0022bytes_in\u0022: 424, \u0022payload_entropy\u0022: 6.0140810797363145, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 63949, \u0022country\u0022: \u0022CA\u0022, \u0022dst_port\u0022: 992, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292607e36297c2dd7c26ee15a59f560ce4af7adff\u0022, \u0022event_fingerprint\u0022: \u00221ee6b107c802b7de6ce3c2d26aba557b14eca19d\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022CA\u0022, \u0022asn\u0022: 63949, \u0022org\u0022: \u0022Akamai Connected Cloud\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022payload_hash\u0022: \u002264d099585a63969c44a66dcf0176ebd8\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003T\ufffd\\u0014\\u001f\ufffd\ufffd\u003C\u0610\ufffd\ufffd\\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\\r\ufffdE\ufffd3\u0027\\u0012\ufffd\ufffdO \ufffdV\\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\\u0018\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003T\ufffd\\u0014\\u001f\ufffd\ufffd\u003C\u0610\ufffd\ufffd\\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\\r\ufffdE\ufffd3\u0027\\u0012\ufffd\ufffdO \ufffdV\\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\\u0018\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\\u0014\ufffd\/\ufffd\u0027\ufffd\\u0013\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003T\ufffd\\u0014\\u001f\ufffd\ufffd\u003C\u0610\ufffd\ufffd\\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\\r\ufffdE\ufffd3\u0027\\u0012\ufffd\ufffdO \ufffdV\\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\\u0018\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221f4ce499015d82af6afaf9f596eb6925c9bc9cd0\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003T\ufffd\\u0014\\u001f\ufffd\ufffd\u003C\u0610\ufffd\ufffd\\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\\r\ufffdE\ufffd3\u0027\\u0012\ufffd\ufffdO \ufffdV\\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\\u0018\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022tls_ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdT\ufffd\ufffd\ufffd\u003C\u0610\ufffd\ufffd\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\\r\ufffdE\ufffd3\u0027\ufffd\ufffdO \ufffdVL\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 992, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003T\ufffd\\u0014\\u001f\ufffd\ufffd\u003C\u0610\ufffd\ufffd\\u0015\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\\r\ufffdE\ufffd3\u0027\\u0012\ufffd\ufffdO \ufffdV\\u0006L\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\\u0018\ufffd[\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022tls_ja3\u0022: \u0022013c30c8ce44c8b27e9ceb2a14db7283\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 992, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:992 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdT\ufffd\ufffd\ufffd\u003C\u0610\ufffd\ufffd\ufffd9\ufffd\u00ef\ufffd\ufffdeX\ufffd\\r\ufffdE\ufffd3\u0027\ufffd\ufffdO \ufffdVL\ufffd7\ufffd\ufffdX\ufffd\ufffd{Zg\ufffdRu4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy-c\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022target_port_label\u0022: \u0022992 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022992\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"013c30c8ce44c8b27e9ceb2a14db7283","tls_ja3":"771,5-4-7-192-132-186-65-157-49313-49309-61-53-156-49312-49308-60-47-10-49169-52243-4867-4868-4869-52392-49271-49270-49249-49248-49200-49192-49172-49199-49191-49171-49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":424}],"total_events":10}