193.32.162.27

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.847905234935865,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3adbd84fd25c0bd3698a8601ddcae948",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdkj\u0000-\u0628\u0002\ufffd\ufffd\u0019\ufffdp~\u000f\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdkj\u0000-\u0628\u0002\ufffd\ufffd\u0019\ufffdp~\u000f\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdkj\u0000-\u0628\u0002\ufffd\ufffd\u0019\ufffdp~\u000f\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdkj\u0000-\u0628\u0002\ufffd\ufffd\u0019\ufffdp~\u000f\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdkj\u0000-\u0628\u0002\ufffd\ufffd\u0019\ufffdp~\u000f\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "779c23155ddb89415d6c931db32dfc2f204ab7e7",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdkj\u0000-\u0628\u0002\ufffd\ufffd\u0019\ufffdp~\u000f\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdkj\u0000-\u0628\u0002\ufffd\ufffd\u0019\ufffdp~\u000f\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdkj-\u0628\ufffd\ufffd\ufffdp~\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdkj\u0000-\u0628\u0002\ufffd\ufffd\u0019\ufffdp~\u000f\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdkj\u0000-\u0628\u0002\ufffd\ufffd\u0019\ufffdp~\u000f\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdkj-\u0628\ufffd\ufffd\ufffdp~\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.863205567857613,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "690bc93f4a943a76cce89900343a4068",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd%\ufffd\ufffd\u0015v;\b\ufffd?\u0006\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd%\ufffd\ufffd\u0015v;\b\ufffd?\u0006\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd%\ufffd\ufffd\u0015v;\b\ufffd?\u0006\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd%\ufffd\ufffd\u0015v;\b\ufffd?\u0006\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd%\ufffd\ufffd\u0015v;\b\ufffd?\u0006\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0c83a03225083a5df0b424dfeb3581b5f17cbb69",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd%\ufffd\ufffd\u0015v;\b\ufffd?\u0006\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd%\ufffd\ufffd\u0015v;\b\ufffd?\u0006\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd%\ufffd\ufffdv;\ufffd?\ufffd\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd%\ufffd\ufffd\u0015v;\b\ufffd?\u0006\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd%\ufffd\ufffd\u0015v;\b\ufffd?\u0006\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd%\ufffd\ufffdv;\ufffd?\ufffd\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.859583910151554,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "879427be76f51d3979d84846b2237660",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ce79c849e1a018c247be5df40e73236ee788c08d",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd#X\ufffd\ufffdK\\]\ufffdO\ufffdZn}OL8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.835529148447621,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3b0b600ce14d7edd6534473c72ee5acf",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b1dcd43be1d1cce7f7eb1cf4d992e23ce1594b6b",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n_6\ufffdc\ufffdl\ufffd]R\ufffd\ufffdk\ufffd\ufffdI\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.8526069836929855,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d7d5b127f09e7c87c4a95e0b3cedf1bc",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdw\ufffd\ufffd\ufffd\u0019G]N\ufffd\ufffd\ufffdrZ+\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdw\ufffd\ufffd\ufffd\u0019G]N\ufffd\ufffd\ufffdrZ+\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdw\ufffd\ufffd\ufffd\u0019G]N\ufffd\ufffd\ufffdrZ+\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdw\ufffd\ufffd\ufffd\u0019G]N\ufffd\ufffd\ufffdrZ+\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdw\ufffd\ufffd\ufffd\u0019G]N\ufffd\ufffd\ufffdrZ+\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6ba5e941a7875ce577fa36affdc8c6fbae793ff8",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdw\ufffd\ufffd\ufffd\u0019G]N\ufffd\ufffd\ufffdrZ+\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdw\ufffd\ufffd\ufffd\u0019G]N\ufffd\ufffd\ufffdrZ+\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdw\ufffd\ufffd\ufffdG]N\ufffd\ufffd\ufffdrZ+\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdw\ufffd\ufffd\ufffd\u0019G]N\ufffd\ufffd\ufffdrZ+\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdw\ufffd\ufffd\ufffd\u0019G]N\ufffd\ufffd\ufffdrZ+\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdw\ufffd\ufffd\ufffdG]N\ufffd\ufffd\ufffdrZ+\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.844751711901494,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a988defcefeb547e2dc09408786613e5",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00140W\ufffd\u0001\u000e\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00140W\ufffd\u0001\u000e\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00140W\ufffd\u0001\u000e\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00140W\ufffd\u0001\u000e\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00140W\ufffd\u0001\u000e\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e7c4b7f305aad480b9d5cfbab81949a003ff8a2f",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00140W\ufffd\u0001\u000e\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00140W\ufffd\u0001\u000e\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n0W\ufffd\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00140W\ufffd\u0001\u000e\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00140W\ufffd\u0001\u000e\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n0W\ufffd\ufffd\ufffd\ufffdd<*\ufffd\ufffd\\mh8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.866912920072338,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "43ab95c1aac51daeeaad35d69704f51b",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5ea709b34191c5a8150ef5dddd6db8fb122203c9",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\u032c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd}\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.846259724598249,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6dbda00aa9d035bd08b4be26220b86bb",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\u000fK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd\u0012\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\u000fK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd\u0012\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\u000fK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd\u0012\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\u000fK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd\u0012\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\u000fK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd\u0012\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e6f7755eab73ece40e32d849358c5004c8d6deb1",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\u000fK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd\u0012\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\u000fK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd\u0012\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\u000fK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd\u0012\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\u000fK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd\u0012\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdK\ufffd\ufffd=y1\ufffd)\ufffdp0\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.855078652046544,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ccb3cb0f1fd4e3fdd23c98c09102d9bb",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014J\ufffdB\ufffd\u001a\\\ufffd1Q\ufffdR@\ufffd\ufffd\u0017z\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014J\ufffdB\ufffd\u001a\\\ufffd1Q\ufffdR@\ufffd\ufffd\u0017z\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014J\ufffdB\ufffd\u001a\\\ufffd1Q\ufffdR@\ufffd\ufffd\u0017z\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014J\ufffdB\ufffd\u001a\\\ufffd1Q\ufffdR@\ufffd\ufffd\u0017z\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014J\ufffdB\ufffd\u001a\\\ufffd1Q\ufffdR@\ufffd\ufffd\u0017z\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "208da53e3dc57206c7d8cab95957cb99d0da0859",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014J\ufffdB\ufffd\u001a\\\ufffd1Q\ufffdR@\ufffd\ufffd\u0017z\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014J\ufffdB\ufffd\u001a\\\ufffd1Q\ufffdR@\ufffd\ufffd\u0017z\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nJ\ufffdB\ufffd\\\ufffd1Q\ufffdR@\ufffd\ufffdz8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014J\ufffdB\ufffd\u001a\\\ufffd1Q\ufffdR@\ufffd\ufffd\u0017z\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014J\ufffdB\ufffd\u001a\\\ufffd1Q\ufffdR@\ufffd\ufffd\u0017z\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nJ\ufffdB\ufffd\\\ufffd1Q\ufffdR@\ufffd\ufffdz8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.846583141637416,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "06d6fc1574b4bfa0a8d63f7816e4ea0c",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd\u001f\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd\u001f\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd\u001f\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd\u001f\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd\u001f\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "490d336917f354611397b59e6e844bb41322be85",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd\u001f\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd\u001f\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd\u001f\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd\u001f\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdnx\ufffd.[\u07f4p\/7\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.829891773202323,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d616fded8dbcdb52df525451f77777a7",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u001a\ufffd\ufffd\ufffds\u0005\\\ufffd0ls\ufffde\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u001a\ufffd\ufffd\ufffds\u0005\\\ufffd0ls\ufffde\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u001a\ufffd\ufffd\ufffds\u0005\\\ufffd0ls\ufffde\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u001a\ufffd\ufffd\ufffds\u0005\\\ufffd0ls\ufffde\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u001a\ufffd\ufffd\ufffds\u0005\\\ufffd0ls\ufffde\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3eb2f7185ffdd8770af871b6855f0717ab812337",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u001a\ufffd\ufffd\ufffds\u0005\\\ufffd0ls\ufffde\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u001a\ufffd\ufffd\ufffds\u0005\\\ufffd0ls\ufffde\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\ufffd\ufffds\\\ufffd0ls\ufffde8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u001a\ufffd\ufffd\ufffds\u0005\\\ufffd0ls\ufffde\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u001a\ufffd\ufffd\ufffds\u0005\\\ufffd0ls\ufffde\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\ufffd\ufffds\\\ufffd0ls\ufffde8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.859796125109168,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "512aa7df78f42eabc1ef4f7105931f7b",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffdd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffdd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffdd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffdd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffdd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7358642bf515fc6333195ffa49edc2723a6c93f7",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffdd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffdd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\ufffdd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffdd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\u0015\ufffdd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd{y\t?^\ufffd\t\ufffd\ufffd\ufffd\ufffdd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.858508089870986,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eb0fe3b845d5bf8196681d73e77ba1ce",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\b\ufffd\u000b\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\b\ufffd\u000b\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\b\ufffd\u000b\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\b\ufffd\u000b\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\b\ufffd\u000b\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0a6a6d6902cd937fb60a2b6cebbbd18e5265c216",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\b\ufffd\u000b\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\b\ufffd\u000b\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\b\ufffd\u000b\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\b\ufffd\u000b\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdFfiK\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.855121649673421,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "198b7717460f0d0e69aa9acdd143d25e",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0010\ufffd^\u001dc\ufffd|\ufffd\ufffd%\ufffd6*\u0012\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0010\ufffd^\u001dc\ufffd|\ufffd\ufffd%\ufffd6*\u0012\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0010\ufffd^\u001dc\ufffd|\ufffd\ufffd%\ufffd6*\u0012\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0010\ufffd^\u001dc\ufffd|\ufffd\ufffd%\ufffd6*\u0012\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0010\ufffd^\u001dc\ufffd|\ufffd\ufffd%\ufffd6*\u0012\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "39fe5d2b378d78fdcd8f5c6afc3610c388718395",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0010\ufffd^\u001dc\ufffd|\ufffd\ufffd%\ufffd6*\u0012\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0010\ufffd^\u001dc\ufffd|\ufffd\ufffd%\ufffd6*\u0012\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd^c\ufffd|\ufffd\ufffd%\ufffd6*\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0010\ufffd^\u001dc\ufffd|\ufffd\ufffd%\ufffd6*\u0012\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0010\ufffd^\u001dc\ufffd|\ufffd\ufffd%\ufffd6*\u0012\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd^c\ufffd|\ufffd\ufffd%\ufffd6*\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.869531634428006,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3397a0c21802b47dac8b620544b66748",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdN\u000eQP\ufffd{<D\u0403\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdN\u000eQP\ufffd{<D\u0403\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdN\u000eQP\ufffd{<D\u0403\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdN\u000eQP\ufffd{<D\u0403\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdN\u000eQP\ufffd{<D\u0403\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b977bc8a20e12f31ddb7040ea27473e0de5f724e",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdN\u000eQP\ufffd{<D\u0403\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdN\u000eQP\ufffd{<D\u0403\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdNQP\ufffd{<D\u0403\ufffd\ufffd#8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdN\u000eQP\ufffd{<D\u0403\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdN\u000eQP\ufffd{<D\u0403\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdNQP\ufffd{<D\u0403\ufffd\ufffd#8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.849970641480927,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f7b65165fdbbf4617f081dcb296512d0",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\ufffd7w\u0014\ufffd\u001a\ufffdg\u001b\u0015\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\ufffd7w\u0014\ufffd\u001a\ufffdg\u001b\u0015\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\ufffd7w\u0014\ufffd\u001a\ufffdg\u001b\u0015\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\ufffd7w\u0014\ufffd\u001a\ufffdg\u001b\u0015\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\ufffd7w\u0014\ufffd\u001a\ufffdg\u001b\u0015\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d6d2d46bf47149ad96671a955f325e1ab8f5bbf8",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\ufffd7w\u0014\ufffd\u001a\ufffdg\u001b\u0015\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\ufffd7w\u0014\ufffd\u001a\ufffdg\u001b\u0015\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdm\ufffd7w\ufffd\ufffdg\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\ufffd7w\u0014\ufffd\u001a\ufffdg\u001b\u0015\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\ufffd7w\u0014\ufffd\u001a\ufffdg\u001b\u0015\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdm\ufffd7w\ufffd\ufffdg\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.848679964365608,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "cb4d9fa15e9bc00df734f300692181fc",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd[\u000f\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd[\u000f\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd[\u000f\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd[\u000f\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd[\u000f\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0395108994837c5d4254375f08bbfc1f999e425e",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd[\u000f\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd[\u000f\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd[\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd[\u000f\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd[\u000f\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd[\ufffd}\ufffd'\ufffdQh\ufffd\/Qe\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.84698952849208,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "81b9550db5f6e03a209aad5ff44fd1c3",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=\n\ufffdt\ufffdcyt\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=\n\ufffdt\ufffdcyt\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=\n\ufffdt\ufffdcyt\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=\n\ufffdt\ufffdcyt\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=\n\ufffdt\ufffdcyt\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "78fb9328bf7160ba8403a043b69d8c53485c3380",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=\n\ufffdt\ufffdcyt\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=\n\ufffdt\ufffdcyt\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n=\n\ufffdt\ufffdcyt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=\n\ufffdt\ufffdcyt\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=\n\ufffdt\ufffdcyt\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n=\n\ufffdt\ufffdcyt\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.8604322170615335,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b42046aac2832d84eb8a4a62ee6855c8",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014o\u0015\u000f\u02f5Y\ufffdS\u0019\ufffd!\ufffdN\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014o\u0015\u000f\u02f5Y\ufffdS\u0019\ufffd!\ufffdN\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014o\u0015\u000f\u02f5Y\ufffdS\u0019\ufffd!\ufffdN\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014o\u0015\u000f\u02f5Y\ufffdS\u0019\ufffd!\ufffdN\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014o\u0015\u000f\u02f5Y\ufffdS\u0019\ufffd!\ufffdN\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8cfa4690518be8125af7db210cede96ea0348081",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014o\u0015\u000f\u02f5Y\ufffdS\u0019\ufffd!\ufffdN\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014o\u0015\u000f\u02f5Y\ufffdS\u0019\ufffd!\ufffdN\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\no\u02f5Y\ufffdS\ufffd!\ufffdN\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014o\u0015\u000f\u02f5Y\ufffdS\u0019\ufffd!\ufffdN\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014o\u0015\u000f\u02f5Y\ufffdS\u0019\ufffd!\ufffdN\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\no\u02f5Y\ufffdS\ufffd!\ufffdN\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.857245330516133,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ccd552506cc3f22e3d0df6cc9cbaad2b",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d6d34923a37f6b7f8d6fc10c875d456d1ef05921",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdD\ufffdu&\ufffd=+\ufffdtD\ufffdY8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.866912920072338,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "18d7469e102cb854333fc59c5d34bb8a",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0013UZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0013UZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0013UZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0013UZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0013UZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d97ee9da72381d38c1ac206ee5656a6d57cf562e",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0013UZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0013UZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nUZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0013UZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0013UZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nUZ\ufffdR\ufffd\ufffd\ufffd\ufffdKVT\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.838435598142737,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "862618f0c3f5808ef839df8cfbfde214",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3j_\ufffd\u06bcl9\ufffd8.\u0017\ufffdp?\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3j_\ufffd\u06bcl9\ufffd8.\u0017\ufffdp?\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3j_\ufffd\u06bcl9\ufffd8.\u0017\ufffdp?\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3j_\ufffd\u06bcl9\ufffd8.\u0017\ufffdp?\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3j_\ufffd\u06bcl9\ufffd8.\u0017\ufffdp?\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6d19990f703b1829d23c51977912a050c940d4e2",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3j_\ufffd\u06bcl9\ufffd8.\u0017\ufffdp?\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3j_\ufffd\u06bcl9\ufffd8.\u0017\ufffdp?\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd3j_\ufffd\u06bcl9\ufffd8.\ufffdp?8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3j_\ufffd\u06bcl9\ufffd8.\u0017\ufffdp?\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3j_\ufffd\u06bcl9\ufffd8.\u0017\ufffdp?\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd3j_\ufffd\u06bcl9\ufffd8.\ufffdp?8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.849563599007878,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "708ce40dfb92ce23ece19bf830f7ca1b",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014T\ufffd\ufffd\ufffd\u0016g^g|\ufffd'\ufffd^Uj'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014T\ufffd\ufffd\ufffd\u0016g^g|\ufffd'\ufffd^Uj'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014T\ufffd\ufffd\ufffd\u0016g^g|\ufffd'\ufffd^Uj'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014T\ufffd\ufffd\ufffd\u0016g^g|\ufffd'\ufffd^Uj'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014T\ufffd\ufffd\ufffd\u0016g^g|\ufffd'\ufffd^Uj'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a8d818f5acab48b7030385e1726f0c7d920290c2",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014T\ufffd\ufffd\ufffd\u0016g^g|\ufffd'\ufffd^Uj'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014T\ufffd\ufffd\ufffd\u0016g^g|\ufffd'\ufffd^Uj'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nT\ufffd\ufffd\ufffdg^g|\ufffd'\ufffd^Uj'8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014T\ufffd\ufffd\ufffd\u0016g^g|\ufffd'\ufffd^Uj'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014T\ufffd\ufffd\ufffd\u0016g^g|\ufffd'\ufffd^Uj'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nT\ufffd\ufffd\ufffdg^g|\ufffd'\ufffd^Uj'8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.850238697380982,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d4ac8661ebf8a6c527ee4404c60f4e73",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd%G\ufffdo4\u001d\ufffd\ufffd\u001d7\u000e\ufffd\ua114\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd%G\ufffdo4\u001d\ufffd\ufffd\u001d7\u000e\ufffd\ua114\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd%G\ufffdo4\u001d\ufffd\ufffd\u001d7\u000e\ufffd\ua114\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd%G\ufffdo4\u001d\ufffd\ufffd\u001d7\u000e\ufffd\ua114\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd%G\ufffdo4\u001d\ufffd\ufffd\u001d7\u000e\ufffd\ua114\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a5dea366a36c9bc7bfb851181d6ecf0040630de0",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd%G\ufffdo4\u001d\ufffd\ufffd\u001d7\u000e\ufffd\ua114\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd%G\ufffdo4\u001d\ufffd\ufffd\u001d7\u000e\ufffd\ua114\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd%G\ufffdo4\ufffd\ufffd7\ufffd\ua1148curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd%G\ufffdo4\u001d\ufffd\ufffd\u001d7\u000e\ufffd\ua114\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd%G\ufffdo4\u001d\ufffd\ufffd\u001d7\u000e\ufffd\ua114\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd%G\ufffdo4\ufffd\ufffd7\ufffd\ua1148curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.854139101080909,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "96e23d75af338f44b83830c56157d408",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Yn\ufffd\ufffd\u001b6k\"\ufffdL%\ufffd\u0006\t)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Yn\ufffd\ufffd\u001b6k\"\ufffdL%\ufffd\u0006\t)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Yn\ufffd\ufffd\u001b6k\"\ufffdL%\ufffd\u0006\t)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Yn\ufffd\ufffd\u001b6k\"\ufffdL%\ufffd\u0006\t)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Yn\ufffd\ufffd\u001b6k\"\ufffdL%\ufffd\u0006\t)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a4eff3555858b6d68a51878ee1ad652e12a0c1b6",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Yn\ufffd\ufffd\u001b6k\"\ufffdL%\ufffd\u0006\t)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Yn\ufffd\ufffd\u001b6k\"\ufffdL%\ufffd\u0006\t)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nYn\ufffd\ufffd6k\"\ufffdL%\ufffd\t)\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Yn\ufffd\ufffd\u001b6k\"\ufffdL%\ufffd\u0006\t)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Yn\ufffd\ufffd\u001b6k\"\ufffdL%\ufffd\u0006\t)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nYn\ufffd\ufffd6k\"\ufffdL%\ufffd\t)\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.858170284546699,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "32efbcf48aa38b72c9b30e2021c1bc44",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014'\ufffd\nS\ufffd\ufffd\u000bu\ufffd\ufffd\ufffdz\ufffd\u001dQ\u0019\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014'\ufffd\nS\ufffd\ufffd\u000bu\ufffd\ufffd\ufffdz\ufffd\u001dQ\u0019\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014'\ufffd\nS\ufffd\ufffd\u000bu\ufffd\ufffd\ufffdz\ufffd\u001dQ\u0019\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014'\ufffd\nS\ufffd\ufffd\u000bu\ufffd\ufffd\ufffdz\ufffd\u001dQ\u0019\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014'\ufffd\nS\ufffd\ufffd\u000bu\ufffd\ufffd\ufffdz\ufffd\u001dQ\u0019\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2477b2f0e2b4172f15c12a4b5f61303888f2404d",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014'\ufffd\nS\ufffd\ufffd\u000bu\ufffd\ufffd\ufffdz\ufffd\u001dQ\u0019\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014'\ufffd\nS\ufffd\ufffd\u000bu\ufffd\ufffd\ufffdz\ufffd\u001dQ\u0019\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n'\ufffd\nS\ufffd\ufffdu\ufffd\ufffd\ufffdz\ufffdQ8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014'\ufffd\nS\ufffd\ufffd\u000bu\ufffd\ufffd\ufffdz\ufffd\u001dQ\u0019\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014'\ufffd\nS\ufffd\ufffd\u000bu\ufffd\ufffd\ufffdz\ufffd\u001dQ\u0019\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n'\ufffd\nS\ufffd\ufffdu\ufffd\ufffd\ufffdz\ufffdQ8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.85337293132976,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7c0f8f67fe189b9b5fe230a2aa36df3d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001419\u0015\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0\u0015 \ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001419\u0015\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0\u0015 \ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001419\u0015\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0\u0015 \ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001419\u0015\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0\u0015 \ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001419\u0015\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0\u0015 \ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "873f3dd7036f4b53d70b65fb7f3ff5f0976b3e67",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001419\u0015\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0\u0015 \ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001419\u0015\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0\u0015 \ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n19\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0 \ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001419\u0015\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0\u0015 \ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001419\u0015\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0\u0015 \ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n19\ufffd\u06f3&\ufffd\ufffd\ufffd\ufffd\\0 \ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.839399000733548,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d5c8d8541ce5aa2c64969ee4f82e9750",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdP\u0005\u000bz\ufffd i\u0004\ufffdu3\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdP\u0005\u000bz\ufffd i\u0004\ufffdu3\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdP\u0005\u000bz\ufffd i\u0004\ufffdu3\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdP\u0005\u000bz\ufffd i\u0004\ufffdu3\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdP\u0005\u000bz\ufffd i\u0004\ufffdu3\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d75e957d47784c51dcc22b4a500a9ae74859b70f",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdP\u0005\u000bz\ufffd i\u0004\ufffdu3\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdP\u0005\u000bz\ufffd i\u0004\ufffdu3\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\ufffdPz\ufffd i\ufffdu3\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdP\u0005\u000bz\ufffd i\u0004\ufffdu3\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdP\u0005\u000bz\ufffd i\u0004\ufffdu3\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\ufffdPz\ufffd i\ufffdu3\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.8390143101605085,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ec5e4f804d3d6ed29a76afc2705926a5",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdFT6\ufffd.-Q\ufffd\u0007gD#\ufffdB\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdFT6\ufffd.-Q\ufffd\u0007gD#\ufffdB\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdFT6\ufffd.-Q\ufffd\u0007gD#\ufffdB\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdFT6\ufffd.-Q\ufffd\u0007gD#\ufffdB\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdFT6\ufffd.-Q\ufffd\u0007gD#\ufffdB\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "06fe492e8d35f026e464d6483717ef5738b79562",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdFT6\ufffd.-Q\ufffd\u0007gD#\ufffdB\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdFT6\ufffd.-Q\ufffd\u0007gD#\ufffdB\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdFT6\ufffd.-Q\ufffdgD#\ufffdB8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdFT6\ufffd.-Q\ufffd\u0007gD#\ufffdB\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdFT6\ufffd.-Q\ufffd\u0007gD#\ufffdB\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdFT6\ufffd.-Q\ufffdgD#\ufffdB8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.843777532465515,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "daf0853c47ddb4cf5b3855425b733c71",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014&\ufffd\ufffda\ufffd\ufffd^~n\u001d\ufffd\u001f\ufffd\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014&\ufffd\ufffda\ufffd\ufffd^~n\u001d\ufffd\u001f\ufffd\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014&\ufffd\ufffda\ufffd\ufffd^~n\u001d\ufffd\u001f\ufffd\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014&\ufffd\ufffda\ufffd\ufffd^~n\u001d\ufffd\u001f\ufffd\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014&\ufffd\ufffda\ufffd\ufffd^~n\u001d\ufffd\u001f\ufffd\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8507e2b072582ced1776d9d78b712285aec3dd13",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014&\ufffd\ufffda\ufffd\ufffd^~n\u001d\ufffd\u001f\ufffd\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014&\ufffd\ufffda\ufffd\ufffd^~n\u001d\ufffd\u001f\ufffd\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n&\ufffd\ufffda\ufffd\ufffd^~n\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014&\ufffd\ufffda\ufffd\ufffd^~n\u001d\ufffd\u001f\ufffd\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014&\ufffd\ufffda\ufffd\ufffd^~n\u001d\ufffd\u001f\ufffd\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n&\ufffd\ufffda\ufffd\ufffd^~n\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.852265554695113,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eee4bca968b60a6f5bd51152444f8065",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00147\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00147\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00147\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00147\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00147\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "54da4b3b1cd6ff7a108d32bd2113ac5db0d67657",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00147\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00147\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n7\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00147\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u00147\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n7\ufffd\ufffdG\\Yf\ufffd^LR_\ufffd)\ufffdy8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.848940822009998,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a47907c7110fd6d3598ad201f278fd0d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd5H\u001d\ufffd\ufffd\u0001\ufffd\ufffd\ufffdIeZ\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd5H\u001d\ufffd\ufffd\u0001\ufffd\ufffd\ufffdIeZ\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd5H\u001d\ufffd\ufffd\u0001\ufffd\ufffd\ufffdIeZ\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd5H\u001d\ufffd\ufffd\u0001\ufffd\ufffd\ufffdIeZ\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd5H\u001d\ufffd\ufffd\u0001\ufffd\ufffd\ufffdIeZ\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b7c4768bce13bc28dff6ae8e250c5f1f6efef0dc",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd5H\u001d\ufffd\ufffd\u0001\ufffd\ufffd\ufffdIeZ\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd5H\u001d\ufffd\ufffd\u0001\ufffd\ufffd\ufffdIeZ\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd5H\ufffd\ufffd\ufffd\ufffd\ufffdIeZ\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd5H\u001d\ufffd\ufffd\u0001\ufffd\ufffd\ufffdIeZ\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd5H\u001d\ufffd\ufffd\u0001\ufffd\ufffd\ufffdIeZ\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd5H\ufffd\ufffd\ufffd\ufffd\ufffdIeZ\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.862779350162075,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9494cbc1b08cc1e841f56ad4c3a3828c",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006\ufffd\ufffd\u0005w`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006\ufffd\ufffd\u0005w`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006\ufffd\ufffd\u0005w`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006\ufffd\ufffd\u0005w`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006\ufffd\ufffd\u0005w`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6e82b1e8e5b5a2b0a219c2ef40ce6e830f45d595",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006\ufffd\ufffd\u0005w`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006\ufffd\ufffd\u0005w`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdw`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006\ufffd\ufffd\u0005w`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006\ufffd\ufffd\u0005w`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdw`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffdQ8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.853207504677372,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "904c8c9b109f500021ec41c7212cdd1d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014O\ufffdp0\ufffd\u0003\u0010\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014O\ufffdp0\ufffd\u0003\u0010\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014O\ufffdp0\ufffd\u0003\u0010\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014O\ufffdp0\ufffd\u0003\u0010\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014O\ufffdp0\ufffd\u0003\u0010\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "354d87b3c38347406c533a159539bbf88baa2686",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014O\ufffdp0\ufffd\u0003\u0010\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014O\ufffdp0\ufffd\u0003\u0010\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nO\ufffdp0\ufffd\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014O\ufffdp0\ufffd\u0003\u0010\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014O\ufffdp0\ufffd\u0003\u0010\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nO\ufffdp0\ufffd\ufffd\ufffdA\ufffd\ufffd ^\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.843377880957835,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5d5126165d6584dcd6d87a8e0f70fc56",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017\n\ufffdM\ufffdz\u0014\ufffd\ufffd6\ufffd(\u001a\ufffde\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017\n\ufffdM\ufffdz\u0014\ufffd\ufffd6\ufffd(\u001a\ufffde\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017\n\ufffdM\ufffdz\u0014\ufffd\ufffd6\ufffd(\u001a\ufffde\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017\n\ufffdM\ufffdz\u0014\ufffd\ufffd6\ufffd(\u001a\ufffde\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017\n\ufffdM\ufffdz\u0014\ufffd\ufffd6\ufffd(\u001a\ufffde\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8113b4ac66321a56e90d9e02791aafa2f1ef4883",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017\n\ufffdM\ufffdz\u0014\ufffd\ufffd6\ufffd(\u001a\ufffde\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017\n\ufffdM\ufffdz\u0014\ufffd\ufffd6\ufffd(\u001a\ufffde\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\n\ufffdM\ufffdz\ufffd\ufffd6\ufffd(\ufffde8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017\n\ufffdM\ufffdz\u0014\ufffd\ufffd6\ufffd(\u001a\ufffde\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017\n\ufffdM\ufffdz\u0014\ufffd\ufffd6\ufffd(\u001a\ufffde\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\n\ufffdM\ufffdz\ufffd\ufffd6\ufffd(\ufffde8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.8428103275874905,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2423a8524e032c57c362b901ce616d01",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd!2B\ufffd_\u0012\ufffdt\ufffd\ufffd-\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd!2B\ufffd_\u0012\ufffdt\ufffd\ufffd-\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd!2B\ufffd_\u0012\ufffdt\ufffd\ufffd-\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd!2B\ufffd_\u0012\ufffdt\ufffd\ufffd-\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd!2B\ufffd_\u0012\ufffdt\ufffd\ufffd-\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "298d283ef0bbdbef58f19c148144f75a014e3185",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd!2B\ufffd_\u0012\ufffdt\ufffd\ufffd-\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd!2B\ufffd_\u0012\ufffdt\ufffd\ufffd-\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd!2B\ufffd_\ufffdt\ufffd\ufffd-\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd!2B\ufffd_\u0012\ufffdt\ufffd\ufffd-\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd!2B\ufffd_\u0012\ufffdt\ufffd\ufffd-\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd!2B\ufffd_\ufffdt\ufffd\ufffd-\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.8315312101059,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "37290d59470fbb7dac0e90e62d2fd28d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A6\u0372\u0000\ufffds\u001c\ufffdO7\ufffd\u0001n\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A6\u0372\u0000\ufffds\u001c\ufffdO7\ufffd\u0001n\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A6\u0372\u0000\ufffds\u001c\ufffdO7\ufffd\u0001n\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A6\u0372\u0000\ufffds\u001c\ufffdO7\ufffd\u0001n\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A6\u0372\u0000\ufffds\u001c\ufffdO7\ufffd\u0001n\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "87b74631eee2d0fd08b3f146b6ea21baa75b8215",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A6\u0372\u0000\ufffds\u001c\ufffdO7\ufffd\u0001n\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A6\u0372\u0000\ufffds\u001c\ufffdO7\ufffd\u0001n\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nA6\u0372\ufffds\ufffdO7\ufffdn\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A6\u0372\u0000\ufffds\u001c\ufffdO7\ufffd\u0001n\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A6\u0372\u0000\ufffds\u001c\ufffdO7\ufffd\u0001n\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nA6\u0372\ufffds\ufffdO7\ufffdn\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.835077633301932,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3c34db22b4d0897c08f5be77ca3b244a",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "271f6c563db660e110bf8cbf3f8b4d8b606f4934",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n39eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n39eEN5D\ufffd.\ufffd\ufffdv0\ufffd;=8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.850600226664402,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "17be30e581b88a38e02ece8181b5b16d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdS1\u0015\ufffd\u06e0,|\ufffdK\u01f5\u0003\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdS1\u0015\ufffd\u06e0,|\ufffdK\u01f5\u0003\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdS1\u0015\ufffd\u06e0,|\ufffdK\u01f5\u0003\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdS1\u0015\ufffd\u06e0,|\ufffdK\u01f5\u0003\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdS1\u0015\ufffd\u06e0,|\ufffdK\u01f5\u0003\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "28931cfccb0dfdc8b347bbc9e98bbc08e9df7332",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdS1\u0015\ufffd\u06e0,|\ufffdK\u01f5\u0003\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdS1\u0015\ufffd\u06e0,|\ufffdK\u01f5\u0003\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdS1\ufffd\u06e0,|\ufffdK\u01f5\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdS1\u0015\ufffd\u06e0,|\ufffdK\u01f5\u0003\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdS1\u0015\ufffd\u06e0,|\ufffdK\u01f5\u0003\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdS1\ufffd\u06e0,|\ufffdK\u01f5\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.856209436575974,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9593ea9a932612a5c4d4e863d75e3fa2",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd(\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0018oGRg<\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd(\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0018oGRg<\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd(\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0018oGRg<\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd(\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0018oGRg<\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd(\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0018oGRg<\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4670581815fa2fbdbdc4da5fb047d36505b8a9ac",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd(\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0018oGRg<\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd(\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0018oGRg<\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdoGRg<8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd(\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0018oGRg<\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd(\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffd\ufffd\u0018oGRg<\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdoGRg<8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.861380072946941,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3ca1062215816902e80805fafcae7fb4",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd78< \ufffd\ufffd\b[x\ufffd\ufffd\ufffd\ufffd]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd78< \ufffd\ufffd\b[x\ufffd\ufffd\ufffd\ufffd]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd78< \ufffd\ufffd\b[x\ufffd\ufffd\ufffd\ufffd]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd78< \ufffd\ufffd\b[x\ufffd\ufffd\ufffd\ufffd]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd78< \ufffd\ufffd\b[x\ufffd\ufffd\ufffd\ufffd]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "13ab8fabd27f9004de18e6bbf114996d221a128e",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd78< \ufffd\ufffd\b[x\ufffd\ufffd\ufffd\ufffd]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd78< \ufffd\ufffd\b[x\ufffd\ufffd\ufffd\ufffd]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd78< \ufffd\ufffd[x\ufffd\ufffd\ufffd\ufffd]\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd78< \ufffd\ufffd\b[x\ufffd\ufffd\ufffd\ufffd]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd78< \ufffd\ufffd\b[x\ufffd\ufffd\ufffd\ufffd]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd78< \ufffd\ufffd[x\ufffd\ufffd\ufffd\ufffd]\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}