{"ip":"195.96.139.108","exported_at":"2026-10-15T11:41:36+00:00","period_days":30,"metrics":{"events7d":7,"distinct_ports":6,"distinct_classifications":5,"max_severity":4,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":45,"attack_stage":"probe","attack_chain_stage":"reconnaissance","threat_family":["scanner"],"recommended_action":"monitor","confidence":0.61,"risk_breakdown":{"waf":8,"classification":42,"behavior":0,"geo":0,"protocol":43,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":6,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 41\/100","campaign_hint_fr":"Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)","confidence_breakdown":{"waf":8,"classification":42,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":41,"correlation_boost":10},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["scan_coordonn\u00e9"],"correlation_flags_labels_fr":["Scan coordonn\u00e9"],"confidence_pct":61,"confidence_hint_fr":"Corr\u00e9lation +10","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0798"],"tags_summary":["pat-0798"],"attack_vector":"coap probe \u00b7 via TLS:5906 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Bq(LJZ2\ufffd-\u03bbfE#\u001a2\ufffd=|L\u0011^\u0007~Z1\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\u000e\ufffdr\ufffdep\u0016\ufffd\u0027*\u001eS\ufffd\ufffd\ufffd\u0016\u001e\u0000\b::\u0013\u0003\u0013\u0002\u0013\u0001\u0001\u0000\u0000g\u0000+\u0000\u0003\u0002\u0003\u0004\u0000\n\u0000\f\u0000\njj\u0000\u0019\u0000\u0018\u0000\u0017\u0000\u001d\u00003\u0000\u0002\u0000\u0000\u0000\r\u0000\u001e\u0000\u001c\b\b\b","tls_ja3":"3f68a72061c9939725c60deed9797431","tls_ja4":"7799ec212572f4067376ae0731fcbd41","port":5906,"service":"tls","service_label_fr":"TLS"},"protocol_summary_fr":"JA3 3f68a72061c99397 \u00b7 Payload \u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Bq(LJZ2\ufffd-\u03bbfE#\u001a2\ufffd=|L\u0011^\u0007~Z1\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\u000e\ufffdr\ufffdep\u0016\ufffd\u0027*\u001e\u2026 \u00b7 TLS:5906","evidence_snippet":"\ufffd\ufffdBq(LJZ2\ufffd-\u03bbfE#2\ufffd=|L^~Z1\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\ufffdr\ufffdep\ufffd\u0027*S\ufffd\ufffd\ufffd::g+\n\njj3","target_port_label":"5906 \u00b7 TLS","emulator_service":"tls","confidence_reason":"Confiance 51 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%","classification_reason_label_fr":"Type \u00ab Sonde CoAP \u00bb (signaux protocolaires) \u00b7 confiance 51%","confidence_factors_fr":"Confiance 61 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10","payload_preview":"\ufffd\ufffdBq(LJZ2\ufffd-\u03bbfE#2\ufffd=|L^~Z1\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\ufffdr\ufffdep\ufffd\u0027*S\ufffd\ufffd\ufffd::g+\n\njj3","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"108.139.96.195.dnsbl.blacklistip.com","listed":true,"available":true,"response":"127.0.0.3","meaning":"Sonde ou scan","label":"Sonde CoAP"},"events":[{"id":1706268,"ip":"195.96.139.108","ts":"2026-10-14 18:24:20.000000","proto":"tcp","src_port":49331,"dst_port":5906,"service":"tls","classification":"coap_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00223f68a72061c9939725c60deed9797431\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 193, \u0022payload_entropy\u0022: 5.594084209340816, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 5906, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 42.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 41, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225c7baf7fb3153f0265670afa4bc33dbef2215227\u0022, \u0022event_fingerprint\u0022: \u002231395f2efb5b61b5e0a5f42c10a22d5efcdc5abd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022confidence\u0022: 0.61, \u0022classification_confidence\u0022: 0.61, \u0022precision_score\u0022: 60, \u0022precision_signals\u0022: [\u0022pat-0798\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0798\u0022], \u0022matched_patterns\u0022: [\u0022pat-0798\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Sigma CoAP GET\u0022, \u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0798\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 51.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00223f68a72061c9939725c60deed9797431\u0022, \u0022payload_hash\u0022: \u0022ed7990858d7d14074ed2597ddaf32c68\u0022, \u0022path_pattern_hash\u0022: \u00222bc9f93b3f58e74e96efca118403941c\u0022, \u0022ja4\u0022: \u00227799ec212572f4067376ae0731fcbd41\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 4, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,14906-4867-4866-4865,43-10-51-13-16-45-28-58-2570,27242-25-24-23-29,\u0022, \u0022tls_ja4_hash\u0022: \u00227799ec212572f4067376ae0731fcbd41\u0022, \u0022tls_ja4\u0022: \u0022t13d0104_e1680fb1a993_f7851bf25266\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 4, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5906, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 41}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bq(LJZ2\ufffd-\u03bbfE#\\u001a2\ufffd=|L\\u0011^\\u0007~Z1\\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\\u000e\ufffdr\ufffdep\\u0016\ufffd\u0027*\\u001eS\ufffd\ufffd\ufffd\\u0016\\u001e\\u0000\\b::\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000g\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\f\\u0000\\njj\\u0000\\u0019\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000\\u0002\\u0000\\u0000\\u0000\\r\\u0000\\u001e\\u0000\\u001c\\b\\b\\b\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bq(LJZ2\ufffd-\u03bbfE#\\u001a2\ufffd=|L\\u0011^\\u0007~Z1\\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\\u000e\ufffdr\ufffdep\\u0016\ufffd\u0027*\\u001eS\ufffd\ufffd\ufffd\\u0016\\u001e\\u0000\\b::\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000g\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\f\\u0000\\njj\\u0000\\u0019\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000\\u0002\\u0000\\u0000\\u0000\\r\\u0000\\u001e\\u0000\\u001c\\b\\b\\b\\u0007\\u0006\\u0003\\b\\u000b\\b\\n\\b\\t\\u0005\\u0003\\u0004\\u0003\\b\\u0006\\b\\u0005\\b\\u0004\\u0006\\u0001\\u0005\\u0001\\u0004\\u0001\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u001c\\u0000\\u0002@\\u0001\\u0000:\\u0000\\u0002\\u0004\\u0000\\n\\n\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bq(LJZ2\ufffd-\u03bbfE#\\u001a2\ufffd=|L\\u0011^\\u0007~Z1\\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\\u000e\ufffdr\ufffdep\\u0016\ufffd\u0027*\\u001eS\ufffd\ufffd\ufffd\\u0016\\u001e\\u0000\\b::\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000g\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\f\\u0000\\njj\\u0000\\u0019\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000\\u0002\\u0000\\u0000\\u0000\\r\\u0000\\u001e\\u0000\\u001c\\b\\b\\b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d1daff43144639428c45ac2b6b235b3ff75f52dc\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bq(LJZ2\ufffd-\u03bbfE#\\u001a2\ufffd=|L\\u0011^\\u0007~Z1\\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\\u000e\ufffdr\ufffdep\\u0016\ufffd\u0027*\\u001eS\ufffd\ufffd\ufffd\\u0016\\u001e\\u0000\\b::\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000g\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\f\\u0000\\njj\\u0000\\u0019\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000\\u0002\\u0000\\u0000\\u0000\\r\\u0000\\u001e\\u0000\\u001c\\b\\b\\b\u0022, \u0022tls_ja3\u0022: \u00223f68a72061c9939725c60deed9797431\u0022, \u0022tls_ja4\u0022: \u00227799ec212572f4067376ae0731fcbd41\u0022, \u0022port\u0022: 5906, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdBq(LJZ2\ufffd-\u03bbfE#2\ufffd=|L^~Z1\\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\ufffdr\ufffdep\ufffd\u0027*S\ufffd\ufffd\ufffd::g+\\n\\njj3\u0022, \u0022attack_vector\u0022: \u0022coap probe \u00b7 via TLS:5906 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225906 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 41\/100\u0022, \u0022confidence_pct\u0022: 61, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 41, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5906, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0798\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0798\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bq(LJZ2\ufffd-\u03bbfE#\\u001a2\ufffd=|L\\u0011^\\u0007~Z1\\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\\u000e\ufffdr\ufffdep\\u0016\ufffd\u0027*\\u001eS\ufffd\ufffd\ufffd\\u0016\\u001e\\u0000\\b::\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000g\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\f\\u0000\\njj\\u0000\\u0019\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000\\u0002\\u0000\\u0000\\u0000\\r\\u0000\\u001e\\u0000\\u001c\\b\\b\\b\u0022, \u0022tls_ja3\u0022: \u00223f68a72061c9939725c60deed9797431\u0022, \u0022tls_ja4\u0022: \u00227799ec212572f4067376ae0731fcbd41\u0022, \u0022port\u0022: 5906, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022coap probe \u00b7 via TLS:5906 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdBq(LJZ2\ufffd-\u03bbfE#2\ufffd=|L^~Z1\\r\ufffd\ufffdl\ufffd C(R\ufffd\u902azsg\ufffd\ufffd\ufffdr\ufffdep\ufffd\u0027*S\ufffd\ufffd\ufffd::g+\\n\\njj3\u0022, \u0022target_port_label\u0022: \u00225906 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 61 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225906\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"3f68a72061c9939725c60deed9797431","tls_ja3":"771,14906-4867-4866-4865,43-10-51-13-16-45-28-58-2570,27242-25-24-23-29,","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":193},{"id":1574886,"ip":"195.96.139.108","ts":"2026-10-14 13:11:29.000000","proto":"tcp","src_port":59381,"dst_port":2627,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022stun.turn\u0022, \u0022stun.nat-discovery\u0022, \u0022h2c\u0022, \u0022webrtc\u0022, \u0022c-webrtc\u0022, \u0022ftp\u0022, \u0022imap\u0022, \u0022pop3\u0022, \u0022managesieve\u0022, \u0022coap\u0022, \u0022co\u0022, \u0022xmpp-client\u0022, \u0022xmpp-server\u0022, \u0022acme-tls\/1\u0022, \u0022mqtt\u0022, \u0022dot\u0022, \u0022ntske\/1\u0022, \u0022sunrpc\u0022, \u0022smb\u0022, \u0022irc\u0022, \u0022nntp\u0022, \u0022nnsp\u0022, \u0022doq\u0022, \u0022sip\/2\u0022, \u0022tds\/8.0\u0022, \u0022dicom\u0022, \u0022postresql\u0022, \u0022radius\/1.0\u0022, \u0022radius\/1.1\u0022, \u0022netperfmeter\/control\u0022, \u0022netperfmeter\/data\u0022, \u0022libp2p\u0022, \u0022qrt\u0022, \u0022wq\u0022, \u0022perf\u0022, \u0022moq\u0022, \u0022moqt\u0022, \u0022h3-ext\u0022, \u0022hq-interop\u0022, \u0022h3-Q046\u0022, \u0022h3-27\u0022, \u0022h3-29\u0022, \u0022h3\u0022, \u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 591, \u0022payload_entropy\u0022: 6.215547225113602, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 2627, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022700b231f346f170c8a88ccb80ac1097b90e94016\u0022, \u0022event_fingerprint\u0022: \u0022104454de27e4a3a55024c46d9d84ee01f978fa7a\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022payload_hash\u0022: \u002205bcc6952b1f8cbdfbdf586dd6051734\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2627, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\\u0019Q\ufffd\ufffd\ufffd\\u0002\ufffd\ufffdeZ\ufffdLg\ufffd\\\u00224l\ufffdUuS8\u02b0\ufffd^:\ufffd\ufffd qa\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\\bt\ufffdvZlk\\u0014a\u003E\\f\\u0006_\\u0011\ufffd\\u0006\ufffd\\b\ufffd[\ufffd}h\\u0016\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\\u0007\ufffdt\u0755\ufffd\\\\K{\u0576\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\\u0019Q\ufffd\ufffd\ufffd\\u0002\ufffd\ufffdeZ\ufffdLg\ufffd\\\u00224l\ufffdUuS8\u02b0\ufffd^:\ufffd\ufffd qa\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\\bt\ufffdvZlk\\u0014a\u003E\\f\\u0006_\\u0011\ufffd\\u0006\ufffd\\b\ufffd[\ufffd}h\\u0016\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\\u0007\ufffdt\u0755\ufffd\\\\K{\u0576\\rx\ufffd@o\\u000f\ufffd\\u0015\\u0004\ufffd$\ufffd\ufffdl\ufffd\ufffd\ufffd9\\u00153\ufffd\u03a8L5M|\ufffdv\ufffd\ufffd\ufffd\ufffd~2\ufffd\ufffd\ufffd4\ufffdU$F\u00d5\ufffd\\t#l\u038c\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\b\\u000b\\b\\n\\b\\t\\b\\u0006\\b\\u0005\\b\\u0004\\u0006\\u0001\\u0005\\u0001\\u0004\\u0001\\u0000\\u0010\\u0001y\\u0001w\\bhttp\/0.9\\bhttp\/1.0\\u0006spdy\/1\\u0006spdy\/2\\u0006spdy\/3\\tstun.t\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\\u0019Q\ufffd\ufffd\ufffd\\u0002\ufffd\ufffdeZ\ufffdLg\ufffd\\\u00224l\ufffdUuS8\u02b0\ufffd^:\ufffd\ufffd qa\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\\bt\ufffdvZlk\\u0014a\u003E\\f\\u0006_\\u0011\ufffd\\u0006\ufffd\\b\ufffd[\ufffd}h\\u0016\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\\u0007\ufffdt\u0755\ufffd\\\\K{\u0576\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d8a8eacc3bc5976149244358800ae89ac2720b4e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\\u0019Q\ufffd\ufffd\ufffd\\u0002\ufffd\ufffdeZ\ufffdLg\ufffd\\\u00224l\ufffdUuS8\u02b0\ufffd^:\ufffd\ufffd qa\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\\bt\ufffdvZlk\\u0014a\u003E\\f\\u0006_\\u0011\ufffd\\u0006\ufffd\\b\ufffd[\ufffd}h\\u0016\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\\u0007\ufffdt\u0755\ufffd\\\\K{\u0576\u0022, \u0022tls_ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022port\u0022: 2627, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022JF\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffdeZ\ufffdLg\ufffd\\\u00224l\ufffdUuS8\u02b0\ufffd^:\ufffd\ufffd qa\ufffd\ufffd\ufffd\ufffd\ufffd\u003Ct\ufffdvZlka\u003E_\ufffd\ufffd\ufffd[\ufffd}h\ufffd+\\n3GEA\ufffd\ufffdt\u0755\ufffd\\\\K{\u0576\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:2627 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222627 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 2627, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\\u0019Q\ufffd\ufffd\ufffd\\u0002\ufffd\ufffdeZ\ufffdLg\ufffd\\\u00224l\ufffdUuS8\u02b0\ufffd^:\ufffd\ufffd qa\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\\bt\ufffdvZlk\\u0014a\u003E\\f\\u0006_\\u0011\ufffd\\u0006\ufffd\\b\ufffd[\ufffd}h\\u0016\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\\u0007\ufffdt\u0755\ufffd\\\\K{\u0576\u0022, \u0022tls_ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022port\u0022: 2627, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:2627 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022JF\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffdeZ\ufffdLg\ufffd\\\u00224l\ufffdUuS8\u02b0\ufffd^:\ufffd\ufffd qa\ufffd\ufffd\ufffd\ufffd\ufffd\u003Ct\ufffdvZlka\u003E_\ufffd\ufffd\ufffd[\ufffd}h\ufffd+\\n3GEA\ufffd\ufffdt\u0755\ufffd\\\\K{\u0576\u0022, \u0022target_port_label\u0022: \u00222627 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222627\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"65bd2d0dd766e11ea0569bd103303509","tls_ja3":"771,4867-4866-4865,43-10-51-13-16-58,23-29,","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":591},{"id":1237741,"ip":"195.96.139.108","ts":"2026-10-14 00:42:50.000000","proto":"tcp","src_port":53999,"dst_port":20257,"service":null,"classification":"xss_attack","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 149, \u0022payload_entropy\u0022: 4.56573432055158, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 20257, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fa159067ea7ef6a6ed6a1ede48eeb1c0074f844b\u0022, \u0022event_fingerprint\u0022: \u0022fed85086d8bc339325a7aa43c8f33e9498a11b71\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022confidence\u0022: 0.69, \u0022classification_confidence\u0022: 0.69, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0284\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0284\u0022], \u0022matched_patterns\u0022: [\u0022pat-0284\u0022, \u0022pat-0103\u0022, \u0022pat-0530\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941130\u0022, \u0022LFI Double-dot bypass\u0022, \u0022XMPP stream\u0022], \u0022pattern_ids\u0022: [\u0022pat-0284\u0022, \u0022pat-0103\u0022, \u0022pat-0530\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 59.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dbe1a27c867fb1a2708880575d568dbe\u0022, \u0022path_pattern_hash\u0022: \u0022e84c630ed8a3a6084c1b662f626e7300\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20257, \u0022risk_score\u0022: 39}, \u0022payload_preview\u0022: \u0022\u003C?xml version=\u00271.0\u0027?\u003E\u003Cstream:stream version=\u00271.0\u0027 xml:lang=\u0027en\u0027 xmlns:stream=\u0027http:\/\/etherx.jabber.org\/streams\u0027 xmlns=\u0027jabber:cl\u0022, \u0022request_sample\u0022: \u0022\u003C?xml version=\u00271.0\u0027?\u003E\u003Cstream:stream version=\u00271.0\u0027 xml:lang=\u0027en\u0027 xmlns:stream=\u0027http:\/\/etherx.jabber.org\/streams\u0027 xmlns=\u0027jabber:client\u0027 to=\u0027localhost\u0027\u003E\u0022, \u0022payload_snippet\u0022: \u0022\u003C?xml version=\u00271.0\u0027?\u003E\u003Cstream:stream version=\u00271.0\u0027 xml:lang=\u0027en\u0027 xmlns:stream=\u0027http:\/\/etherx.jabber.org\/streams\u0027 xmlns=\u0027jabber:cl\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\u003C?xml version=\u00271.0\u0027?\u003E\u003Cstream:stream version=\u00271.0\u0027 xml:lang=\u0027en\u0027 xmlns:stream=\u0027http:\/\/etherx.jabber.org\/streams\u0027 xmlns=\u0027jabber:client\u0027 to=\u0027localhost\u0027\u003E\u0022, \u0022payload_snippet\u0022: \u0022\u003C?xml version=\u00271.0\u0027?\u003E\u003Cstream:stream version=\u00271.0\u0027 xml:lang=\u0027en\u0027 xmlns:stream=\u0027http:\/\/etherx.jabber.org\/streams\u0027 xmlns=\u0027jabber:cl\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c4ddb76b7fbd9ba9e1ad09c270aa6ac29b7c1b9d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\u003C?xml version=\u00271.0\u0027?\u003E\u003Cstream:stream version=\u00271.0\u0027 xml:lang=\u0027en\u0027 xmlns:stream=\u0027http:\/\/etherx.jabber.org\/streams\u0027 xmlns=\u0027jabber:cl\u0022, \u0022port\u0022: 20257}, \u0022evidence_snippet\u0022: \u0022\u003C?xml version=\u00271.0\u0027?\u003E\u003Cstream:stream version=\u00271.0\u0027 xml:lang=\u0027en\u0027 xmlns:stream=\u0027http:\/\/etherx.jabber.org\/streams\u0027 xmlns=\u0027jabber:cl\u0022, \u0022attack_vector\u0022: \u0022xss attack \u00b7 port 20257 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u002220257\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 campagne \/24 (195.96.139.0\/24)\u0022, \u0022confidence_pct\u0022: 69, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20257, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0284\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0284\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\u003C?xml version=\u00271.0\u0027?\u003E\u003Cstream:stream version=\u00271.0\u0027 xml:lang=\u0027en\u0027 xmlns:stream=\u0027http:\/\/etherx.jabber.org\/streams\u0027 xmlns=\u0027jabber:cl\u0022, \u0022port\u0022: 20257}, \u0022attack_vector\u0022: \u0022xss attack \u00b7 port 20257 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\u003C?xml version=\u00271.0\u0027?\u003E\u003Cstream:stream version=\u00271.0\u0027 xml:lang=\u0027en\u0027 xmlns:stream=\u0027http:\/\/etherx.jabber.org\/streams\u0027 xmlns=\u0027jabber:cl\u0022, \u0022target_port_label\u0022: \u002220257\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220257\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":149},{"id":142395,"ip":"195.96.139.108","ts":"2026-10-12 00:22:59.000000","proto":"tcp","src_port":34063,"dst_port":20180,"service":null,"classification":"proxy_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 9, \u0022payload_entropy\u0022: 3.169925001442312, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 20180, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022606f8c1e49a1ee26c33ea391adbf7a30b834a19d\u0022, \u0022event_fingerprint\u0022: \u0022f985d49a72728719fb52f46d9af942fbd4893fe5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.1, \u0022classification_confidence\u0022: 0.1, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022996516018670e4883395b7770b98ffaf\u0022, \u0022path_pattern_hash\u0022: \u0022b6d4fb956dc4d23d1c2c3eccd7f8e7e3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20180, \u0022risk_score\u0022: 24}, \u0022payload_preview\u0022: \u0022\\u0004\\u0001yh\ufffd`\ufffdl\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001yh\ufffd`\ufffdl\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001yh\ufffd`\ufffdl\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0004\\u0001yh\ufffd`\ufffdl\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001yh\ufffd`\ufffdl\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002269d36bf8aac722a09a40f9dca21d3b8e7b1b0a4f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0004\\u0001yh\ufffd`\ufffdl\\u0000\u0022, \u0022port\u0022: 20180}, \u0022evidence_snippet\u0022: \u0022yh\ufffd`\ufffdl\u0022, \u0022attack_vector\u0022: \u0022proxy probe \u00b7 port 20180 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002220180\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 10, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20180, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0004\\u0001yh\ufffd`\ufffdl\\u0000\u0022, \u0022port\u0022: 20180}, \u0022attack_vector\u0022: \u0022proxy probe \u00b7 port 20180 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022yh\ufffd`\ufffdl\u0022, \u0022target_port_label\u0022: \u002220180\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220180\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022socks4_greeting\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 84}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022socks4_greeting\u0022]","anomalies":"[]","severity":4,"bytes_in":9},{"id":142394,"ip":"195.96.139.108","ts":"2026-10-12 00:22:56.000000","proto":"tcp","src_port":41541,"dst_port":20180,"service":null,"classification":"proxy_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 3, \u0022payload_entropy\u0022: 1.584962500721156, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 20180, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b8e9e981c35cfa00d76e928a498b4971876df658\u0022, \u0022event_fingerprint\u0022: \u0022f985d49a72728719fb52f46d9af942fbd4893fe5\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022da075e9d699084fc189cdd233081c49f\u0022, \u0022path_pattern_hash\u0022: \u0022b6d4fb956dc4d23d1c2c3eccd7f8e7e3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20180, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225a59a304aff297c52c6991af740271966e5d202a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022port\u0022: 20180}, \u0022attack_vector\u0022: \u0022proxy probe \u00b7 port 20180 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002220180\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20180, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0001\\u0000\u0022, \u0022port\u0022: 20180}, \u0022attack_vector\u0022: \u0022proxy probe \u00b7 port 20180 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002220180\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220180\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022socks5_greeting\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022socks5_greeting\u0022]","anomalies":"[]","severity":4,"bytes_in":3},{"id":82745,"ip":"195.96.139.108","ts":"2026-10-11 21:51:15.000000","proto":"tcp","src_port":51967,"dst_port":9814,"service":"tls","classification":"coap_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022e14575e772d1611f0c331ad08f2f6a43\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 284, \u0022payload_entropy\u0022: 6.197582743593582, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 9814, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 42.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 41, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022af9e8577668a19de83ae6637b60ab5013e699ef2\u0022, \u0022event_fingerprint\u0022: \u00229c050a876a02fc3e37a98fc5c95c317ea0b1840c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022confidence\u0022: 0.61, \u0022classification_confidence\u0022: 0.61, \u0022precision_score\u0022: 60, \u0022precision_signals\u0022: [\u0022pat-0798\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0798\u0022], \u0022matched_patterns\u0022: [\u0022pat-0798\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Sigma CoAP GET\u0022, \u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0798\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 51.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022e14575e772d1611f0c331ad08f2f6a43\u0022, \u0022payload_hash\u0022: \u0022646d87fcc99ff56dd3742f516d2dd93e\u0022, \u0022path_pattern_hash\u0022: \u00222bc9f93b3f58e74e96efca118403941c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9814, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 41}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0017\\u0001\\u0000\\u0001\\u0013\\u0003\\u0003{\\b\ufffd\ufffdb=\ufffdV\ufffd#|\ufffd\ufffd%N\ufffd\ufffdP\ufffd\ufffd\ufffd\u030b\\u0001\ufffd\\u0004c\ufffd3;\ufffd !A\ufffd\ufffdDR1\\u0016I\ufffd\ufffdQG\ufffd\ufffd[G\ufffd\ufffdF\ufffdR\\u0002\\u0001q5\u0026\u034f=)\ufffd\\u0000\\b\\n\\n\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\n\\u0000\\bzz\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\\u001a3\ufffd\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0017\\u0001\\u0000\\u0001\\u0013\\u0003\\u0003{\\b\ufffd\ufffdb=\ufffdV\ufffd#|\ufffd\ufffd%N\ufffd\ufffdP\ufffd\ufffd\ufffd\u030b\\u0001\ufffd\\u0004c\ufffd3;\ufffd !A\ufffd\ufffdDR1\\u0016I\ufffd\ufffdQG\ufffd\ufffd[G\ufffd\ufffdF\ufffdR\\u0002\\u0001q5\u0026\u034f=)\ufffd\\u0000\\b\\n\\n\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\n\\u0000\\bzz\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\\u001a3\ufffd\ufffd\ufde1\ufffd\ufffd1\ufffdB\ufffd\ufffd\ufffdo\u07ab\u02b2\ufffd\ufffd9g\ufffd\ufffd@{=\ufffd6\ufffd:\ufffd\ufffd\\u001aJZ\ufffd=\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~l\ufffd\\u0014\ufffd\ufffdp\ufffdY\ufffd,\ufffdL\ufffd\ufffdN\ufffdq\\u0000\\r\\u0000\\u001e\\u0000\\u001c\\b\\b\\b\\u0007\\u0006\\u0003\\b\\u000b\\b\\n\\b\\t\\u0005\\u0003\\u0004\\u0003\\b\\u0006\\b\\u0005\\b\\u0004\\u0006\\u0001\\u0005\\u0001\\u0004\\u0001\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u001b\\u0000\\u0007\\u0006\\u0000\\u0002\\u0000\\u0001\\u0000\\u0003\\u0000\\u001c\\u0000\\u0002@\\u0001D\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0017\\u0001\\u0000\\u0001\\u0013\\u0003\\u0003{\\b\ufffd\ufffdb=\ufffdV\ufffd#|\ufffd\ufffd%N\ufffd\ufffdP\ufffd\ufffd\ufffd\u030b\\u0001\ufffd\\u0004c\ufffd3;\ufffd !A\ufffd\ufffdDR1\\u0016I\ufffd\ufffdQG\ufffd\ufffd[G\ufffd\ufffdF\ufffdR\\u0002\\u0001q5\u0026\u034f=)\ufffd\\u0000\\b\\n\\n\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\n\\u0000\\bzz\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\\u001a3\ufffd\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002217efaed708016597f3d90458b67dd60aa44ad074\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0017\\u0001\\u0000\\u0001\\u0013\\u0003\\u0003{\\b\ufffd\ufffdb=\ufffdV\ufffd#|\ufffd\ufffd%N\ufffd\ufffdP\ufffd\ufffd\ufffd\u030b\\u0001\ufffd\\u0004c\ufffd3;\ufffd !A\ufffd\ufffdDR1\\u0016I\ufffd\ufffdQG\ufffd\ufffd[G\ufffd\ufffdF\ufffdR\\u0002\\u0001q5\u0026\u034f=)\ufffd\\u0000\\b\\n\\n\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\n\\u0000\\bzz\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\\u001a3\ufffd\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022e14575e772d1611f0c331ad08f2f6a43\u0022, \u0022port\u0022: 9814, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022{\ufffd\ufffdb=\ufffdV\ufffd#|\ufffd\ufffd%N\ufffd\ufffdP\ufffd\ufffd\ufffd\u030b\ufffdc\ufffd3;\ufffd !A\ufffd\ufffdDR1I\ufffd\ufffdQG\ufffd\ufffd[G\ufffd\ufffdF\ufffdRq5\u0026\u034f=)\ufffd\\n\\n\ufffd+\\n\\nzz3GEA3\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022coap probe \u00b7 via TLS:9814 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00229814 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 41\/100\u0022, \u0022confidence_pct\u0022: 61, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 41, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9814, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0798\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0798\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0017\\u0001\\u0000\\u0001\\u0013\\u0003\\u0003{\\b\ufffd\ufffdb=\ufffdV\ufffd#|\ufffd\ufffd%N\ufffd\ufffdP\ufffd\ufffd\ufffd\u030b\\u0001\ufffd\\u0004c\ufffd3;\ufffd !A\ufffd\ufffdDR1\\u0016I\ufffd\ufffdQG\ufffd\ufffd[G\ufffd\ufffdF\ufffdR\\u0002\\u0001q5\u0026\u034f=)\ufffd\\u0000\\b\\n\\n\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\n\\u0000\\bzz\\u0000\\u0018\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\\u001a3\ufffd\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022e14575e772d1611f0c331ad08f2f6a43\u0022, \u0022port\u0022: 9814, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022coap probe \u00b7 via TLS:9814 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022{\ufffd\ufffdb=\ufffdV\ufffd#|\ufffd\ufffd%N\ufffd\ufffdP\ufffd\ufffd\ufffd\u030b\ufffdc\ufffd3;\ufffd !A\ufffd\ufffdDR1I\ufffd\ufffdQG\ufffd\ufffd[G\ufffd\ufffdF\ufffdRq5\u0026\u034f=)\ufffd\\n\\n\ufffd+\\n\\nzz3GEA3\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00229814 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 61 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229814\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"e14575e772d1611f0c331ad08f2f6a43","tls_ja3":"771,2570-4867-4866-4865,43-10-51-13-16-27-28-17513-49-45-58-56026,31354-24-23-29,","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":284},{"id":39428,"ip":"195.96.139.108","ts":"2026-10-11 18:15:05.000000","proto":"tcp","src_port":39185,"dst_port":26214,"service":null,"classification":"mongodb_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 44, \u0022payload_entropy\u0022: 1.6761360291184577, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 26214, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 55.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002292a2a637565d03336efb24f512d25a8b9dcf95da\u0022, \u0022event_fingerprint\u0022: \u0022e9886f0a3c92918e3edbbf96fad427850deec761\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0532\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab mongodb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002227a86d8c3413d5c279270a134dcbb540\u0022, \u0022path_pattern_hash\u0022: \u002264fbc3aee24db4a0fc1ea9e5fbb0e29c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 26214, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\\u0000\\u0000(\ufffd\ufffdX\\u0010\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0002\\u0000\\u0001\ufffd\ufffd\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\ufffd\\u0000\\u0000(\ufffd\ufffdX\\u0010\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0002\\u0000\\u0001\ufffd\ufffd\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\\u0000\\u0000(\ufffd\ufffdX\\u0010\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0002\\u0000\\u0001\ufffd\ufffd\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\\u0000\\u0000(\ufffd\ufffdX\\u0010\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0002\\u0000\\u0001\ufffd\ufffd\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\\u0000\\u0000(\ufffd\ufffdX\\u0010\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0002\\u0000\\u0001\ufffd\ufffd\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mongodb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222ca5aeaa6f1673df2de58127a5d1c74cb6030f6a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\\u0000\\u0000(\ufffd\ufffdX\\u0010\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0002\\u0000\\u0001\ufffd\ufffd\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 26214}, \u0022evidence_snippet\u0022: \u0022\ufffd(\ufffd\ufffdX\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022mongodb probe \u00b7 port 26214 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002226214\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mongodb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mongodb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 26214, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0532\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0532\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\\u0000\\u0000(\ufffd\ufffdX\\u0010\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0002\\u0000\\u0001\ufffd\ufffd\\u0000\\u0000\\u0000\\u0004\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 26214}, \u0022attack_vector\u0022: \u0022mongodb probe \u00b7 port 26214 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd(\ufffd\ufffdX\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002226214\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002226214\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mongodb_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mongodb_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":44}],"total_events":7}