{"ip":"195.96.139.201","exported_at":"2026-10-13T02:41:32+00:00","period_days":30,"metrics":{"events7d":5,"distinct_ports":5,"distinct_classifications":3,"max_severity":5,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":50,"attack_stage":"probe","attack_chain_stage":"reconnaissance","threat_family":["scanner","IP signal\u00e9e (IPsum, 3 listes ou plus)"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":30,"novelty":0},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":5,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RSYNC \u2014 campagne \/24 (195.96.139.0\/24)","campaign_hint_fr":"Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)","confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50,"correlation_boost":10},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["scan_coordonn\u00e9"],"correlation_flags_labels_fr":["Scan coordonn\u00e9"],"confidence_pct":100,"confidence_hint_fr":"Corr\u00e9lation +10","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0374","pat-0533","pat-0865"],"tags_summary":["pat-0374","pat-0533","pat-0865"],"attack_vector":"memcached probe \u00b7 via RSYNC:873 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"stats","port":873,"service":"rsync","service_label_fr":"RSYNC"},"protocol_summary_fr":"Payload stats \u00b7 RSYNC:873","evidence_snippet":"stats","target_port_label":"873 \u00b7 RSYNC","emulator_service":"rsync","confidence_reason":"Confiance 100 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","classification_reason_label_fr":"Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10","payload_preview":"stats","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":true,"label_fr":"IP signal\u00e9e (IPsum, 3 listes ou plus)","detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"events":[{"id":611046,"ip":"195.96.139.201","ts":"2026-10-12 19:52:49.000000","proto":"tcp","src_port":55383,"dst_port":873,"service":"rsync","classification":"memcached_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022405253594e43443a2033312e3020686f6e6579706f74207273796e630a405253594e43443a2033312e3020686f6e6579706f74206d6f64756c65730a\u0022, \u0022emulator_response_len\u0022: 60, \u0022bytes_in\u0022: 7, \u0022payload_entropy\u0022: 2.2359263506290326, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: \u0022rsync\u0022, \u0022app_proto\u0022: \u0022rsync\u0022, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 873, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002298869b42f64d34be0059fbdde025b21bd08f7d09\u0022, \u0022event_fingerprint\u0022: \u0022b8e7f2d6a44abcd0eaea4d28adc634b3cbaedb93\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 164, \u0022precision_signals\u0022: [\u0022pat-0374\u0022, \u0022pat-0533\u0022, \u0022pat-0865\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0374\u0022, \u0022pat-0533\u0022, \u0022pat-0865\u0022], \u0022matched_patterns\u0022: [\u0022pat-0374\u0022, \u0022pat-0533\u0022, \u0022pat-0865\u0022], \u0022matched_pattern_names\u0022: [\u0022Memcached stats\u0022, \u0022Memcached stats\u0022, \u0022ET Memcached UDP\u0022], \u0022pattern_ids\u0022: [\u0022pat-0374\u0022, \u0022pat-0533\u0022, \u0022pat-0865\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rsync\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002211e629574907d3a9ced402e26f4a98df\u0022, \u0022path_pattern_hash\u0022: \u0022549d36783f9e3c43618e715d78a40b3b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 873, \u0022service\u0022: \u0022rsync\u0022, \u0022service_name\u0022: \u0022rsync\u0022, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022stats\\r\\n\u0022, \u0022request_sample\u0022: \u0022stats\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022stats\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022stats\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022stats\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222b6d74e339d19fd00674ba4feb275b406634c875\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022stats\u0022, \u0022port\u0022: 873, \u0022service\u0022: \u0022rsync\u0022, \u0022service_label_fr\u0022: \u0022RSYNC\u0022}, \u0022evidence_snippet\u0022: \u0022stats\u0022, \u0022attack_vector\u0022: \u0022memcached probe \u00b7 via RSYNC:873 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022873 \u00b7 RSYNC\u0022, \u0022emulator_service\u0022: \u0022rsync\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RSYNC \u2014 campagne \/24 (195.96.139.0\/24)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rsync\u0022, \u0022service_label_fr\u0022: \u0022RSYNC\u0022, \u0022dst_port\u0022: 873, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0374\u0022, \u0022pat-0533\u0022, \u0022pat-0865\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0374\u0022, \u0022pat-0533\u0022, \u0022pat-0865\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rsync\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022stats\u0022, \u0022port\u0022: 873, \u0022service\u0022: \u0022rsync\u0022, \u0022service_label_fr\u0022: \u0022RSYNC\u0022}, \u0022attack_vector\u0022: \u0022memcached probe \u00b7 via RSYNC:873 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022stats\u0022, \u0022target_port_label\u0022: \u0022873 \u00b7 RSYNC\u0022, \u0022emulator_service\u0022: \u0022rsync\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rsync\u0022, \u0022service_banner\u0022: \u0022honeypot-rsync\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022873\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022net_rsync_probe\u0022, \u0022rsync_emulated\u0022, \u0022rsync_payload\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rsync_probe\u0022, \u0022rsync_emulated\u0022, \u0022rsync_payload\u0022]","anomalies":"[]","severity":5,"bytes_in":7},{"id":263035,"ip":"195.96.139.201","ts":"2026-10-12 05:45:58.000000","proto":"tcp","src_port":36081,"dst_port":1200,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022stun.turn\u0022, \u0022stun.nat-discovery\u0022, \u0022h2c\u0022, \u0022webrtc\u0022, \u0022c-webrtc\u0022, \u0022ftp\u0022, \u0022imap\u0022, \u0022pop3\u0022, \u0022managesieve\u0022, \u0022coap\u0022, \u0022co\u0022, \u0022xmpp-client\u0022, \u0022xmpp-server\u0022, \u0022acme-tls\/1\u0022, \u0022mqtt\u0022, \u0022dot\u0022, \u0022ntske\/1\u0022, \u0022sunrpc\u0022, \u0022smb\u0022, \u0022irc\u0022, \u0022nntp\u0022, \u0022nnsp\u0022, \u0022doq\u0022, \u0022sip\/2\u0022, \u0022tds\/8.0\u0022, \u0022dicom\u0022, \u0022postresql\u0022, \u0022radius\/1.0\u0022, \u0022radius\/1.1\u0022, \u0022netperfmeter\/control\u0022, \u0022netperfmeter\/data\u0022, \u0022libp2p\u0022, \u0022qrt\u0022, \u0022wq\u0022, \u0022perf\u0022, \u0022moq\u0022, \u0022moqt\u0022, \u0022h3-ext\u0022, \u0022hq-interop\u0022, \u0022h3-Q046\u0022, \u0022h3-27\u0022, \u0022h3-29\u0022, \u0022h3\u0022, \u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 591, \u0022payload_entropy\u0022: 6.218015085960075, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 1200, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e61bc4a1784998fd3fdb7de1ea19365e0b940fa2\u0022, \u0022event_fingerprint\u0022: \u00228d05a870c56cc9f450c443d19f23a26bfbde07c8\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022payload_hash\u0022: \u00221e53be67ff7d387d5f904db11334a4a5\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1200, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\/\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd= \ufffd!Y\\u0006\ufffd\\u0012\ufffd@H\ufffd \ufffd\\u0014`\ufffd \ufffd\ufffdg\ufffd\/\ufffd\ufffd\u0156\ufffd8\ufffdWx\ufffd\ufffd6C\ufffd\ufffd\ufffd84=\ufffd\ufffdw\ufffd1\\u0010 g\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\u07a2\ufffdV\\t\\u00078a-\\u0016$\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\/\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd= \ufffd!Y\\u0006\ufffd\\u0012\ufffd@H\ufffd \ufffd\\u0014`\ufffd \ufffd\ufffdg\ufffd\/\ufffd\ufffd\u0156\ufffd8\ufffdWx\ufffd\ufffd6C\ufffd\ufffd\ufffd84=\ufffd\ufffdw\ufffd1\\u0010 g\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\u07a2\ufffdV\\t\\u00078a-\\u0016$\\u0013\ufffd\ufffdQ\ufffd\ufffd\ufffd?\ufffd0\\rJ\\u001d\u0677\\\u0022\ufffd\\u0006\ufffd\ufffd\\u0011Xt\ufffd}\u03fe\ufffdA+\ufffd\ufffd\u05db\u00a4\\n\ufffd82e\ufffd\ufffdl\\u001b\ufffd\\u0006\ufffd\\u001f\ufffdJ\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\b\\u000b\\b\\n\\b\\t\\b\\u0006\\b\\u0005\\b\\u0004\\u0006\\u0001\\u0005\\u0001\\u0004\\u0001\\u0000\\u0010\\u0001y\\u0001w\\bhttp\/0.9\\bhttp\/1.0\\u0006spdy\/1\\u0006spdy\/2\\u0006spdy\/3\\tstun.t\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\/\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd= \ufffd!Y\\u0006\ufffd\\u0012\ufffd@H\ufffd \ufffd\\u0014`\ufffd \ufffd\ufffdg\ufffd\/\ufffd\ufffd\u0156\ufffd8\ufffdWx\ufffd\ufffd6C\ufffd\ufffd\ufffd84=\ufffd\ufffdw\ufffd1\\u0010 g\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\u07a2\ufffdV\\t\\u00078a-\\u0016$\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f91540a78139f7c74f05b59437fef87687751e24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\/\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd= \ufffd!Y\\u0006\ufffd\\u0012\ufffd@H\ufffd \ufffd\\u0014`\ufffd \ufffd\ufffdg\ufffd\/\ufffd\ufffd\u0156\ufffd8\ufffdWx\ufffd\ufffd6C\ufffd\ufffd\ufffd84=\ufffd\ufffdw\ufffd1\\u0010 g\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\u07a2\ufffdV\\t\\u00078a-\\u0016$\u0022, \u0022tls_ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022port\u0022: 1200, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022JF\ufffd\/\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd= \ufffd!Y\ufffd\ufffd@H\ufffd \ufffd`\ufffd \ufffd\ufffdg\ufffd\/\ufffd\ufffd\u0156\ufffd8\ufffdWx\ufffd\ufffd6C\ufffd\ufffd\ufffd84=\ufffd\ufffdw\ufffd1 g\ufffd+\\n3GEA\ufffd\u07a2\ufffdV\\t8a-$\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1200 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221200 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 1200, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\ufffd\/\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd= \ufffd!Y\\u0006\ufffd\\u0012\ufffd@H\ufffd \ufffd\\u0014`\ufffd \ufffd\ufffdg\ufffd\/\ufffd\ufffd\u0156\ufffd8\ufffdWx\ufffd\ufffd6C\ufffd\ufffd\ufffd84=\ufffd\ufffdw\ufffd1\\u0010 g\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004\ufffd\u07a2\ufffdV\\t\\u00078a-\\u0016$\u0022, \u0022tls_ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022port\u0022: 1200, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:1200 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022JF\ufffd\/\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd= \ufffd!Y\ufffd\ufffd@H\ufffd \ufffd`\ufffd \ufffd\ufffdg\ufffd\/\ufffd\ufffd\u0156\ufffd8\ufffdWx\ufffd\ufffd6C\ufffd\ufffd\ufffd84=\ufffd\ufffdw\ufffd1 g\ufffd+\\n3GEA\ufffd\u07a2\ufffdV\\t8a-$\u0022, \u0022target_port_label\u0022: \u00221200 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221200\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"65bd2d0dd766e11ea0569bd103303509","tls_ja3":"771,4867-4866-4865,43-10-51-13-16-58,23-29,","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":591},{"id":152164,"ip":"195.96.139.201","ts":"2026-10-12 00:54:55.000000","proto":"tcp","src_port":57779,"dst_port":555,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 555, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d65cbcc3ab1333da153a926961b6c8d94faa1aa0\u0022, \u0022event_fingerprint\u0022: \u0022f1854331fef3181fd58e9a292c8ca64426863852\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 10}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 555, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d6d1ad54063100ecd2963ce9456bbc5b4659c49c\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 555}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 555 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022555\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 555, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 555}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 555 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u0022555\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022555\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":119069,"ip":"195.96.139.201","ts":"2026-10-11 23:26:06.000000","proto":"tcp","src_port":33151,"dst_port":30125,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022stun.turn\u0022, \u0022stun.nat-discovery\u0022, \u0022h2c\u0022, \u0022webrtc\u0022, \u0022c-webrtc\u0022, \u0022ftp\u0022, \u0022imap\u0022, \u0022pop3\u0022, \u0022managesieve\u0022, \u0022coap\u0022, \u0022co\u0022, \u0022xmpp-client\u0022, \u0022xmpp-server\u0022, \u0022acme-tls\/1\u0022, \u0022mqtt\u0022, \u0022dot\u0022, \u0022ntske\/1\u0022, \u0022sunrpc\u0022, \u0022smb\u0022, \u0022irc\u0022, \u0022nntp\u0022, \u0022nnsp\u0022, \u0022doq\u0022, \u0022sip\/2\u0022, \u0022tds\/8.0\u0022, \u0022dicom\u0022, \u0022postresql\u0022, \u0022radius\/1.0\u0022, \u0022radius\/1.1\u0022, \u0022netperfmeter\/control\u0022, \u0022netperfmeter\/data\u0022, \u0022libp2p\u0022, \u0022qrt\u0022, \u0022wq\u0022, \u0022perf\u0022, \u0022moq\u0022, \u0022moqt\u0022, \u0022h3-ext\u0022, \u0022hq-interop\u0022, \u0022h3-Q046\u0022, \u0022h3-27\u0022, \u0022h3-29\u0022, \u0022h3\u0022, \u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 591, \u0022payload_entropy\u0022: 6.2043614557353886, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 30125, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022337e048e9379df85e098e8efe39ad782a3de633e\u0022, \u0022event_fingerprint\u0022: \u00223318fb91d43f8cd31ac5dc77b261bb2c6b7f8ea4\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022payload_hash\u0022: \u00226232fa66784a3d6a4af7a3fc7a36c401\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 30125, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\\u0013\ufffd\ufffd\ufffd)G\ufffd\ufffd\\u0010\ufffdz\ufffdhF\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdS$\u0026\\u0001\ufffdd\ufffd-1dw\ufffd \u0754\ufffd\ufffd\ufffd~as;9\u0027\ufffd\ufffdcx\u0026\ufffd4b\ufffd\u0762f\ufffd\u00d9y\\u0016\u036dX\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004K\\u001cIK\ufffd\\u0017\ufffd\ufffd\u0376\\b_\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\\u0013\ufffd\ufffd\ufffd)G\ufffd\ufffd\\u0010\ufffdz\ufffdhF\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdS$\u0026\\u0001\ufffdd\ufffd-1dw\ufffd \u0754\ufffd\ufffd\ufffd~as;9\u0027\ufffd\ufffdcx\u0026\ufffd4b\ufffd\u0762f\ufffd\u00d9y\\u0016\u036dX\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004K\\u001cIK\ufffd\\u0017\ufffd\ufffd\u0376\\b_\ufffd\ufffd^\\u0015\ufffd%S\ufffd\\u0011\ufffdI\ufffdt\ufffdf\\u0014\ufffd\ub645\ufffd\ufffdo\ufffdgY\\u0001%\ufffdH\ufffd\ufffdJc\ufffd\ufffd\ufffd\ufffdjm\ufffd\ufffd\ufffd+jk\\u0015y\ufffd\ufffd}\\u0002\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\b\\u000b\\b\\n\\b\\t\\b\\u0006\\b\\u0005\\b\\u0004\\u0006\\u0001\\u0005\\u0001\\u0004\\u0001\\u0000\\u0010\\u0001y\\u0001w\\bhttp\/0.9\\bhttp\/1.0\\u0006spdy\/1\\u0006spdy\/2\\u0006spdy\/3\\tstun.t\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\\u0013\ufffd\ufffd\ufffd)G\ufffd\ufffd\\u0010\ufffdz\ufffdhF\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdS$\u0026\\u0001\ufffdd\ufffd-1dw\ufffd \u0754\ufffd\ufffd\ufffd~as;9\u0027\ufffd\ufffdcx\u0026\ufffd4b\ufffd\u0762f\ufffd\u00d9y\\u0016\u036dX\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004K\\u001cIK\ufffd\\u0017\ufffd\ufffd\u0376\\b_\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e6526f7babb1c222c1d8ed5e98812076a98a8c83\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\\u0013\ufffd\ufffd\ufffd)G\ufffd\ufffd\\u0010\ufffdz\ufffdhF\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdS$\u0026\\u0001\ufffdd\ufffd-1dw\ufffd \u0754\ufffd\ufffd\ufffd~as;9\u0027\ufffd\ufffdcx\u0026\ufffd4b\ufffd\u0762f\ufffd\u00d9y\\u0016\u036dX\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004K\\u001cIK\ufffd\\u0017\ufffd\ufffd\u0376\\b_\u0022, \u0022tls_ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022port\u0022: 30125, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022JF\ufffd\ufffd\ufffd)G\ufffd\ufffd\ufffdz\ufffdhF\ufffd\ufffd\ufffd\ufffd\ufffdS$\u0026\ufffdd\ufffd-1dw\ufffd \u0754\ufffd\ufffd\ufffd~as;9\u0027\ufffd\ufffdcx\u0026\ufffd4b\ufffd\u0762f\ufffd\u00d9y\u036dX\ufffd+\\n3GEAKIK\ufffd\ufffd\ufffd\u0376_\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:30125 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002230125 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 30125, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002J\\u0001\\u0000\\u0002F\\u0003\\u0003\\u0013\ufffd\ufffd\ufffd)G\ufffd\ufffd\\u0010\ufffdz\ufffdhF\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdS$\u0026\\u0001\ufffdd\ufffd-1dw\ufffd \u0754\ufffd\ufffd\ufffd~as;9\u0027\ufffd\ufffdcx\u0026\ufffd4b\ufffd\u0762f\ufffd\u00d9y\\u0016\u036dX\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004K\\u001cIK\ufffd\\u0017\ufffd\ufffd\u0376\\b_\u0022, \u0022tls_ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022port\u0022: 30125, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:30125 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022JF\ufffd\ufffd\ufffd)G\ufffd\ufffd\ufffdz\ufffdhF\ufffd\ufffd\ufffd\ufffd\ufffdS$\u0026\ufffdd\ufffd-1dw\ufffd \u0754\ufffd\ufffd\ufffd~as;9\u0027\ufffd\ufffdcx\u0026\ufffd4b\ufffd\u0762f\ufffd\u00d9y\u036dX\ufffd+\\n3GEAKIK\ufffd\ufffd\ufffd\u0376_\u0022, \u0022target_port_label\u0022: \u002230125 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002230125\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"65bd2d0dd766e11ea0569bd103303509","tls_ja3":"771,4867-4866-4865,43-10-51-13-16-58,23-29,","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":591},{"id":22664,"ip":"195.96.139.201","ts":"2026-10-11 12:28:41.000000","proto":"tcp","src_port":41397,"dst_port":5502,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/0.9\u0022, \u0022http\/1.0\u0022, \u0022spdy\/1\u0022, \u0022spdy\/2\u0022, \u0022spdy\/3\u0022, \u0022stun.turn\u0022, \u0022stun.nat-discovery\u0022, \u0022h2c\u0022, \u0022webrtc\u0022, \u0022c-webrtc\u0022, \u0022ftp\u0022, \u0022imap\u0022, \u0022pop3\u0022, \u0022managesieve\u0022, \u0022coap\u0022, \u0022co\u0022, \u0022xmpp-client\u0022, \u0022xmpp-server\u0022, \u0022acme-tls\/1\u0022, \u0022mqtt\u0022, \u0022dot\u0022, \u0022ntske\/1\u0022, \u0022sunrpc\u0022, \u0022smb\u0022, \u0022irc\u0022, \u0022nntp\u0022, \u0022nnsp\u0022, \u0022doq\u0022, \u0022sip\/2\u0022, \u0022tds\/8.0\u0022, \u0022dicom\u0022, \u0022postresql\u0022, \u0022radius\/1.0\u0022, \u0022radius\/1.1\u0022, \u0022netperfmeter\/control\u0022, \u0022netperfmeter\/data\u0022, \u0022libp2p\u0022, \u0022qrt\u0022, \u0022wq\u0022, \u0022perf\u0022, \u0022moq\u0022, \u0022moqt\u0022, \u0022h3-ext\u0022, \u0022hq-interop\u0022, \u0022h3-Q046\u0022, \u0022h3-27\u0022, \u0022h3-29\u0022, \u0022h3\u0022, \u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 583, \u0022payload_entropy\u0022: 6.253664947344043, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 211298, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 5502, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022be216b6a7ab6723586fa4f2f11bc7e0ab7848f16\u0022, \u0022event_fingerprint\u0022: \u0022d7a2505744ae5d4a99361785d52e7b74700651f4\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 211298, \u0022org\u0022: \u0022Driftnet Ltd\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022payload_hash\u0022: \u0022c3b18c0e81c7428e8b63e75689cb9e44\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5502, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002B\\u0001\\u0000\\u0002\u003E\\u0003\\u0003\ufffd`Z\ufffdq\ufffdh\ufffd\\u0003\ufffd\u07c6\ufffd\u003C\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0557\ufffd\ufffd\ufffdS\ufffdi \ufffd\u06dcAp\ufffd\u0337\\u001d\ufffd0\ufffd\ufffdb\ufffd_\ufffd(\\u001f\ufffd\ufffd\\fQ\ufffd\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004,\ufffd\\u0015\ufffd\\u0011z\\\\\u003E\\u0015y\ufffdn\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002B\\u0001\\u0000\\u0002\u003E\\u0003\\u0003\ufffd`Z\ufffdq\ufffdh\ufffd\\u0003\ufffd\u07c6\ufffd\u003C\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0557\ufffd\ufffd\ufffdS\ufffdi \ufffd\u06dcAp\ufffd\u0337\\u001d\ufffd0\ufffd\ufffdb\ufffd_\ufffd(\\u001f\ufffd\ufffd\\fQ\ufffd\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004,\ufffd\\u0015\ufffd\\u0011z\\\\\u003E\\u0015y\ufffdno\ufffd3{\ufffdH\ufffd!\u003E\ufffd7\ufffd\u0154\ufffd\ufffd*\\u0002\\u000f\u03d9P^\ufffdT\ufffd*\ufffdw\ufffdh7\ufffd\ufffd`H\\u0016\ufffd\u00275\\u0011VK\\u0010\ufffd\ufffdr\ufffd\u07f1k\\u0015\\u0000\\r\\u0000\\f\\u0000\\n\\b\\b\\b\\u0007\\u0006\\u0003\\u0005\\u0003\\u0004\\u0003\\u0000\\u0010\\u0001y\\u0001w\\bhttp\/0.9\\bhttp\/1.0\\u0006spdy\/1\\u0006spdy\/2\\u0006spdy\/3\\tstun.turn\\u0012stun\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002B\\u0001\\u0000\\u0002\u003E\\u0003\\u0003\ufffd`Z\ufffdq\ufffdh\ufffd\\u0003\ufffd\u07c6\ufffd\u003C\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0557\ufffd\ufffd\ufffdS\ufffdi \ufffd\u06dcAp\ufffd\u0337\\u001d\ufffd0\ufffd\ufffdb\ufffd_\ufffd(\\u001f\ufffd\ufffd\\fQ\ufffd\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004,\ufffd\\u0015\ufffd\\u0011z\\\\\u003E\\u0015y\ufffdn\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229727475023d2aa8d0ab3e66d4efa68de7b07e300\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002B\\u0001\\u0000\\u0002\u003E\\u0003\\u0003\ufffd`Z\ufffdq\ufffdh\ufffd\\u0003\ufffd\u07c6\ufffd\u003C\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0557\ufffd\ufffd\ufffdS\ufffdi \ufffd\u06dcAp\ufffd\u0337\\u001d\ufffd0\ufffd\ufffdb\ufffd_\ufffd(\\u001f\ufffd\ufffd\\fQ\ufffd\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004,\ufffd\\u0015\ufffd\\u0011z\\\\\u003E\\u0015y\ufffdn\u0022, \u0022tls_ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022port\u0022: 5502, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022B\u003E\ufffd`Z\ufffdq\ufffdh\ufffd\ufffd\u07c6\ufffd\u003C\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0557\ufffd\ufffd\ufffdS\ufffdi \ufffd\u06dcAp\ufffd\u0337\ufffd0\ufffd\ufffdb\ufffd_\ufffd(\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\\n3GEA,\ufffd\ufffdz\\\\\u003Ey\ufffdn\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5502 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225502 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5502, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002B\\u0001\\u0000\\u0002\u003E\\u0003\\u0003\ufffd`Z\ufffdq\ufffdh\ufffd\\u0003\ufffd\u07c6\ufffd\u003C\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0557\ufffd\ufffd\ufffdS\ufffdi \ufffd\u06dcAp\ufffd\u0337\\u001d\ufffd0\ufffd\ufffdb\ufffd_\ufffd(\\u001f\ufffd\ufffd\\fQ\ufffd\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\u0000\\u0006\\u0013\\u0003\\u0013\\u0002\\u0013\\u0001\\u0001\\u0000\\u0001\ufffd\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u001d\\u00003\\u0000G\\u0000E\\u0000\\u0017\\u0000A\\u0004,\ufffd\\u0015\ufffd\\u0011z\\\\\u003E\\u0015y\ufffdn\u0022, \u0022tls_ja3\u0022: \u002265bd2d0dd766e11ea0569bd103303509\u0022, \u0022port\u0022: 5502, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5502 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022B\u003E\ufffd`Z\ufffdq\ufffdh\ufffd\ufffd\u07c6\ufffd\u003C\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0557\ufffd\ufffd\ufffdS\ufffdi \ufffd\u06dcAp\ufffd\u0337\ufffd0\ufffd\ufffdb\ufffd_\ufffd(\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\\n3GEA,\ufffd\ufffdz\\\\\u003Ey\ufffdn\u0022, \u0022target_port_label\u0022: \u00225502 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225502\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022195.96.139.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"65bd2d0dd766e11ea0569bd103303509","tls_ja3":"771,4867-4866-4865,43-10-51-13-16-58,23-29,","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":583}],"total_events":5}