Fiche IP

États-Unis

198.211.109.144

Activité suspecte — risque 51/100 (Moyen) — MITRE T1190 — confiance 100 % — via HTTP

FAI DigitalOcean, LLC Première vue 22/10/2026 01:13 UTC Dernière vue 23/10/2026 20:34 UTC Risque Moyen

Période 2026-10-02 → 2026-11-01

Moyen 64/100

24h 7j 30j 90j

Synthèse

Score de risque max. 64/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 22/10/2026 01:13 UTC

Dernière observation 23/10/2026 20:34 UTC

Événements (période) 84

Décision conseillée Investiguer Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal TA0007 50 occurrences

Pourquoi listée

Sonde fichier sensible / config · confiance 100%

Confiance 100 % — Score WAF 32 · 1 tag(s) WAF

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

64/100 Confiance 100 % 84 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 198.211.109.144
Décision : Investiguer
Score max : 64/100 (Moyen)
Confiance : 100 %
Période : 2026-10-02 → 2026-11-01 · 84 événements
Motif : Sonde fichier sensible / config · confiance 100%
MITRE : TA0007
FAI : DigitalOcean, LLC · États-Unis

Comparaison ASN / FAI

ASN 14061 · 198.211.96.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 84 événements sur la période pour cette IP.

137.184.32.56 Tentative d'exploit 01/11/2026 22:20 UTC
146.190.153.30 Tentative d'exploit 01/11/2026 22:18 UTC
64.225.74.178 Tentative d'exploit 01/11/2026 22:18 UTC
165.227.199.158 SSRF 01/11/2026 22:13 UTC
165.227.188.42 Tentative d'exploit 01/11/2026 22:11 UTC
137.184.190.205 Tentative d'exploit 01/11/2026 22:10 UTC
159.89.124.112 Tentative d'exploit 01/11/2026 22:08 UTC
64.23.161.101 Tentative d'exploit 01/11/2026 22:07 UTC

Événements (filtres)

Première observation

22/10/2026 01:13 UTC

Dernière observation

23/10/2026 20:34 UTC

Dernière activité (filtres)

23/10/2026 20:34 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

—

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 25 TLS TCP 15 COUCHDB TCP 7 ELASTICSEARCH TCP 6 MEMCACHED TCP 5 KAFKA CONTROLLER TCP 5 MONGODB TCP 4 ELASTICSEARCH NODE TCP 4 MONGODB CONFIG TCP 4 HTTP ALT 8087 TCP 3 SAP Diag TCP 2 MSSQL TCP 2 MYSQL TCP 1 POSTGRES TCP 1

HTTP

TLS

COUCHDB

ELASTICSEARCH

MEMCACHED

KAFKA CONTROLLER

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

DigitalOcean, LLC 0 Port 15671 Traversal LFI

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

qnap qts auth bypass · via HTTP:15671 · (sonde / probe) · → /cgi-bin/authLogin.cgi

Détails protocole

Méthode: GET
Chemin: /cgi-bin/authLogin.cgi
User-Agent: Go-http-client/1.1

Aperçu payload

GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:15671 User-Agent: Go-http-client/1.1 Connection: close

Port / service

15671 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — Motif catalogue confirmé · 1 tag(s) WAF

Technique MITRE

T1190

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

Cve 2025 11628 pat-fb-041

Confiance

100%

Famille de menace

unknown

MITRE ATT&CK — tactiques observées

Découverte Accès initial

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

84 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

84 événement(s) — page 2/4

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
23/10/2026 07:16:52 UTC	TCP	29092 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:29092 · (tentative d'exploit) · → /solr/admin/cores	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 Accès Exécution Protocole GET /solr/admin/cores UA Go-http-client/1.1 Émulateur HTTP WAF 13 Recommandation Investiguer Tags 950325:rce-0 950468:nosqli-3 http_admin_panel_probe http_admin_panel_scan Cible HTTP GET /solr/admin/cores TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 29092 Chemin / cible /solr/admin/cores Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 54 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1 Host: 62.3.50.33:29092 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":2,"http_path_depth":3,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"8ab58e916690f18287f0bf2fe745b0cb6e241d5b","http_target_hash":"6b03df1c77d35ae8990130ccd8ec9b9323ec38c0","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":131,"payload_entropy":5.0899818118160045,"port_category":"registered","org":"DigitalOcean, LLC","service":"http","app_proto":"http","asn":14061,"country":"US","dst_port":29092,"risk_waf":60,"risk_classification":74,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":25,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":60,"classification":74,"behavior":0,"geo":40,"protocol":35,"novelty":25},"risk_score":54,"tag_count":7,"anomaly_count":0,"campaign_key":"3dfcb2520ddb5b8583134a60e654a6a668af337d","event_fingerprint":"465281dc9119706ba820db7ddb5596db662373da","classification_reason":"Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":127,"precision_signals":["INT-http_sensitive","INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-http_sensitive","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":60,"classification":74,"behavior":0,"geo":40,"protocol":35,"novelty":25,"risk_score":54,"correlation_boost":8},"named_…
23/10/2026 07:16:51 UTC	TCP	29092 · TLS	tls	Sonde TLS tls probe · via TLS:29092 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole JA3 d6828e30ab66774a Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 29092 Chemin / cible — Service TLS Payload ��}%6� q��0��^ 7�$ ��w L #�A��' g��@�F��٪��\|�%�S�@&�+�/�,�0̨̩� �� /5� { Pourquoi cette classification : Type « Sonde TLS » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) ��}%6� q��0��^ 7�$ ��w L #�A��' g��@�F��٪��\|�%�S�@&�+�/�,�0̨̩� �� /5� { Requête brute (extrait) ��}%6� q��0��^ 7�$ ��w L #�A��' g��@�F��٪��\|�%�S�@&�+�/�,�0̨̩� �� /5� { �+3&$ ��Q�lb� �-�fx<��&U2�R՟�VE Meta JSON brut {"tls_ja3_hash":"d6828e30ab66774a91a96ae93be4ae4c","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":4,"bytes_in":243,"payload_entropy":5.749025112048144,"port_category":"registered","org":"DigitalOcean, LLC","service":"tls","app_proto":"tls","asn":14061,"country":"US","dst_port":29092,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":3.3,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15},"risk_score":24,"tag_count":3,"anomaly_count":0,"campaign_key":"404da510ecdfb3b2dcb22d45da6ff050ebcceb27","event_fingerprint":"b013a6ac8e43cf8cc9616a9a24357bb16f8ceb69","classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15,"risk_score":24,"correlation_boost":8},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"ja3":"d6828e30ab66774a91a96ae93be4ae4c","payload_hash":"a23a1e4cf907ff94e7005f4d11a81403","path_pattern_hash":"8792d2cfdc5028123bfb8f159de8656c","ja4":"e4d60caa902b8b84112358f96af813c3"…
23/10/2026 07:16:51 UTC	TCP	29092 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:29092 · (tentative d'exploit) · → /solr/admin/info/system	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 Accès Exécution Protocole GET /solr/admin/info/system UA Go-http-client/1.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_admin_panel_probe http_admin_panel_scan http_probe_solr Cible HTTP GET /solr/admin/info/system TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 29092 Chemin / cible /solr/admin/info/system Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97% Confiance classification 97% Risque capteur Moyen · 46 Confiance : Confiance 97 % — 1 tag(s) WAF Signaux Http Sensitive Upstream Technique MITRE T1083 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /solr/admin/info/system HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF nosqli-3 Payload (extrait) GET /solr/admin/info/system HTTP/1.1 Host: 62.3.50.33:29092 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":4,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"8ab58e916690f18287f0bf2fe745b0cb6e241d5b","http_target_hash":"fc0e9dcca87dcc3e0fb0c7105f0dc0965b093249","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":115,"payload_entropy":4.963301657145085,"port_category":"registered","org":"DigitalOcean, LLC","service":"http","app_proto":"http","asn":14061,"country":"US","dst_port":29092,"risk_waf":32,"risk_classification":74,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":25,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":32,"classification":74,"behavior":0,"geo":40,"protocol":35,"novelty":25},"risk_score":46,"tag_count":6,"anomaly_count":0,"campaign_key":"4e5436d5e0a200be0fef266ecf80703bb4fd3b4b","event_fingerprint":"08d759aa74468c0558535cd17917c47154c0c3c3","classification_reason":"Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%","confidence":0.97,"classification_confidence":0.97,"precision_score":97,"precision_signals":["INT-http_sensitive","INT-upstream"],"kb_rule_ids":["INT-http_sensitive","INT-upstream"],"confidence_breakdown":{"waf":32,"classification":74,"behavior":0,"geo":40,"protocol":35,"novelty":25,"risk_score":46},"named_classification_skipped":false,"classification_pa…
23/10/2026 06:47:12 UTC	TCP	5984 · COUCHDB	couchdb	Sonde CouchDB couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload couchdb_probe couchdb_rest_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Type « Sonde CouchDB » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Infra Couchdb Db Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534","emulator_response_len":286,"bytes_in":100,"payload_entropy":5.018339231412708,"port_category":"registered","org":"DigitalOcean, LLC","service":"couchdb","app_proto":"couchdb","asn":14061,"country":"US","dst_port":5984,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":40,"risk_protocol":40,"risk_novelty":25,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":25},"risk_score":48,"tag_count":6,"anomaly_count":0,"campaign_key":"eeb24ede3f547bd086820dac13d3da57d36ee8f1","event_fingerprint":"ff7d4ab9a5d149e36f724b4980f53d45ea707dff","classification_reason":"Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":87,"precision_signals":["INT-INFRA-couchdb-db","INT-upstream"],"kb_rule_ids":["INT-INFRA-couchdb-db","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":25,"risk_score":48},"named_classification_skipped":false,"service_name":"couchdb","risk_confidence_factor":95,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country…
23/10/2026 06:47:12 UTC	TCP	5984 · COUCHDB	couchdb	Sonde CouchDB couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload http_get_probe net_couchdb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Type « Sonde CouchDB » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534","emulator_response_len":286,"bytes_in":92,"payload_entropy":4.87892518064,"port_category":"registered","org":"DigitalOcean, LLC","service":"couchdb","app_proto":"couchdb","asn":14061,"country":"US","dst_port":5984,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":40,"risk_protocol":40,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":15},"risk_score":34,"tag_count":4,"anomaly_count":0,"campaign_key":"b9cfd159ba211c85f74ecb49bfdc67c2c17a2f04","event_fingerprint":"ff7d4ab9a5d149e36f724b4980f53d45ea707dff","classification_reason":"Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":15,"risk_score":34},"named_classification_skipped":false,"service_name":"couchdb","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"…
23/10/2026 06:46:24 UTC	TCP	5984 · COUCHDB	couchdb	Sonde CouchDB couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole JA3 d6828e30ab66774a Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload net_couchdb_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload ��U��qd0a��f��O�' ��>�vg �݁m$/�֊ ��!��<Uݹ<��Z{�u&�+�/�,�0̨̩� �� /5� { Pourquoi cette classification : Type « Sonde CouchDB » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) ��U��qd0a��f��O�' ��>�vg �݁m$/�֊��!��<Uݹ<��Z{�u&�+�/�,�0̨̩� �� /5� { Requête brute (extrait) ��U��qd0a��f��O�' ��>�vg �݁m$/�֊ ��!��<Uݹ<��Z{�u&�+�/�,�0̨̩� �� /5� { �+3&$ �0�A�<�VDZ��1#��pÌ J3j�G Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534","emulator_response_len":286,"bytes_in":243,"payload_entropy":5.81133907045952,"port_category":"registered","org":"DigitalOcean, LLC","service":"couchdb","app_proto":"couchdb","asn":14061,"country":"US","dst_port":5984,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":40,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":30,"novelty":15},"risk_score":34,"tag_count":4,"anomaly_count":0,"campaign_key":"2a6ad211f73352e00bbd648921c2250031621d4a","event_fingerprint":"ff7d4ab9a5d149e36f724b4980f53d45ea707dff","classification_reason":"Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":30,"novelty":15,"risk_score":34},"named_classification_skipped":false,"service_name":"couchdb","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":fals…
23/10/2026 06:46:24 UTC	TCP	5984 · COUCHDB	couchdb	Sonde CouchDB couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload http_get_probe net_couchdb_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Pourquoi cette classification : Type « Sonde CouchDB » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534","emulator_response_len":286,"bytes_in":96,"payload_entropy":4.9679567776251305,"port_category":"registered","org":"DigitalOcean, LLC","service":"couchdb","app_proto":"couchdb","asn":14061,"country":"US","dst_port":5984,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":40,"risk_protocol":40,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":15},"risk_score":34,"tag_count":4,"anomaly_count":0,"campaign_key":"b9cfd159ba211c85f74ecb49bfdc67c2c17a2f04","event_fingerprint":"ff7d4ab9a5d149e36f724b4980f53d45ea707dff","classification_reason":"Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":15,"risk_score":34},"named_classification_skipped":false,"service_name":"couchdb","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":fal…
23/10/2026 06:46:23 UTC	TCP	5984 · COUCHDB	couchdb	Bruteforce IMAP imap bruteforce · via COUCHDB:5984 · (sonde / probe)	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1110 Découverte Accès Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload http_get_probe imap_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Type « Bruteforce IMAP » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 41 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Email Imap Login Technique MITRE T1110 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534","emulator_response_len":286,"bytes_in":113,"payload_entropy":4.978186406658893,"port_category":"registered","org":"DigitalOcean, LLC","service":"couchdb","app_proto":"couchdb","asn":14061,"country":"US","dst_port":5984,"risk_waf":8,"risk_classification":66,"risk_behavior":0,"risk_geo":40,"risk_protocol":40,"risk_novelty":25,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":66,"behavior":0,"geo":40,"protocol":40,"novelty":25},"risk_score":41,"tag_count":5,"anomaly_count":0,"campaign_key":"ff5df85c211d5d3903035b95f6de1ea630b4065b","event_fingerprint":"ff7d4ab9a5d149e36f724b4980f53d45ea707dff","classification_reason":"Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":76,"precision_signals":["INT-EMAIL-imap-login"],"kb_rule_ids":["INT-EMAIL-imap-login"],"confidence_breakdown":{"waf":8,"classification":66,"behavior":0,"geo":40,"protocol":40,"novelty":25,"risk_score":41},"named_classification_skipped":false,"service_name":"couchdb","risk_confidence_factor":95,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"Di…
23/10/2026 06:46:23 UTC	TCP	5984 · COUCHDB	couchdb	Sonde CouchDB couchdb probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload http_get_probe mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accep Pourquoi cette classification : Type « Sonde CouchDB » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accep Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accept-Encoding: gzip Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534","emulator_response_len":286,"bytes_in":148,"payload_entropy":5.1552211233484355,"port_category":"registered","org":"DigitalOcean, LLC","service":"couchdb","app_proto":"couchdb","asn":14061,"country":"US","dst_port":5984,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":40,"risk_protocol":40,"risk_novelty":25,"risk_boost":20,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":25},"risk_score":34,"tag_count":5,"anomaly_count":0,"campaign_key":"cd4aa24d616b8c8c9fdc7b65c18cba1fa792652c","event_fingerprint":"ff7d4ab9a5d149e36f724b4980f53d45ea707dff","classification_reason":"Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":40,"novelty":25,"risk_score":34},"named_classification_skipped":false,"service_name":"couchdb","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":f…
23/10/2026 06:46:23 UTC	TCP	5984 · COUCHDB	couchdb	Sonde Elasticsearch elasticsearch probe · via COUCHDB:5984 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur COUCHDB WAF — Recommandation Surveiller Tags couchdb_emulated couchdb_payload elastic_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5984 Chemin / cible — Service COUCHDB Payload GET /v2/_catalog HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Type « Sonde Elasticsearch » (signaux protocolaires) · confiance 56% Confiance classification 56% Risque capteur Faible · 33 Confiance : Confiance 56 % — Motif catalogue confirmé Protocole émulé 1 Signaux Infra Elastic Cat Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET /v2/_catalog HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534","emulator_response_len":286,"bytes_in":103,"payload_entropy":4.991417616346634,"port_category":"registered","org":"DigitalOcean, LLC","service":"couchdb","app_proto":"couchdb","asn":14061,"country":"US","dst_port":5984,"risk_waf":8,"risk_classification":58,"risk_behavior":0,"risk_geo":40,"risk_protocol":40,"risk_novelty":25,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":58,"behavior":0,"geo":40,"protocol":40,"novelty":25},"risk_score":33,"tag_count":5,"anomaly_count":0,"campaign_key":"8247f8bc9e2c8f7cec55e7efc443f19241dd1163","event_fingerprint":"ff7d4ab9a5d149e36f724b4980f53d45ea707dff","classification_reason":"Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 56%","confidence":0.56,"classification_confidence":0.56,"precision_score":66,"precision_signals":["INT-INFRA-elastic-cat"],"kb_rule_ids":["INT-INFRA-elastic-cat"],"confidence_breakdown":{"waf":8,"classification":58,"behavior":0,"geo":40,"protocol":40,"novelty":25,"risk_score":33},"named_classification_skipped":false,"service_name":"couchdb","risk_confidence_factor":56,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"or…
23/10/2026 03:38:58 UTC	TCP	3306 · MYSQL	mysql	Sonde MySQL mysql probe · via MYSQL:3306 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1110 Découverte Accès Protocole Émulateur MYSQL WAF — Recommandation Surveiller Tags mysql_emulated mysql_handshake net_mysql_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3306 Chemin / cible — Service MYSQL Pourquoi cette classification : Poignée de main MySQL · confiance 95% Confiance classification 95% Risque capteur Moyen · 48 Confiance : Confiance 95 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Db Mysql Auth Upstream Technique MITRE T1110 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400","emulator_response_len":60,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"DigitalOcean, LLC","service":"mysql","app_proto":"mysql","asn":14061,"country":"US","dst_port":3306,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":40,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":36,"novelty":0},"risk_score":48,"tag_count":3,"anomaly_count":0,"campaign_key":"bef1cad8d681313ebc2fad5890e78941ae733f15","event_fingerprint":"7e64d2ea7efbfd080eb620b69c685e7503a67a61","classification_reason":"Poign\u00e9e de main MySQL \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":87,"precision_signals":["INT-DB-mysql-auth","INT-upstream"],"kb_rule_ids":["INT-DB-mysql-auth","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":40,"protocol":36,"novelty":0,"risk_score":48},"named_classification_skipped":false,"service_name":"mysql","risk_confidence_factor":95,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"f92b97805e8111d6d69ad0f096b65c87"},"target_conte…
22/10/2026 23:15:28 UTC	TCP	9200 · ELASTICSEARCH	elasticsearch	Sonde Elasticsearch elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)	Élevée	Faible · 22
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole JA3 d6828e30ab66774a Sonde Elasticsearch (REST) Émulateur ELASTICSEARCH WAF — Recommandation Surveiller Tags elasticsearch_emulated elasticsearch_tcp_probe net_elasticsearch_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9200 Chemin / cible — Service ELASTICSEARCH Payload ��nF��P�>��Ȟ_f��@^z�"�� q�(�~�CJx�1�5��\|�3J�f�� x&�+�/�,�0̨̩� �� /5� { Pourquoi cette classification : Type « Sonde Elasticsearch » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 22 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) ��nF��P�>��Ȟ_f��@^z�"�� q�(�~�CJx�1�5��\|�3J�f�� x&�+�/�,�0̨̩� �� /5� { Requête brute (extrait) ��nF��P�>��Ȟ_f��@^z�"�� q�(�~�CJx�1�5��\|�3J�f�� x&�+�/�,�0̨̩� �� /5� { �+3&$ �ĉ�� __�6��1�:v�xo��0nq Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"bytes_in":243,"payload_entropy":5.801575893777069,"port_category":"registered","org":"DigitalOcean, LLC","service":"elasticsearch","app_proto":"elasticsearch","asn":14061,"country":"US","dst_port":9200,"risk_waf":8,"risk_classification":58,"risk_behavior":0,"risk_geo":40,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.2,"risk_breakdown":{"waf":8,"classification":58,"behavior":0,"geo":40,"protocol":30,"novelty":15},"risk_score":22,"tag_count":4,"anomaly_count":0,"campaign_key":"93abadea2248805c510cdc75076bd41245b4474e","event_fingerprint":"64ce65412bf1b81fa23464b76dd480979155e3d0","classification_reason":"Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":58,"behavior":0,"geo":40,"protocol":30,"novelty":15,"risk_score":22},"named_classification_skipped":false,"service_name":"elasticsearch","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter…
22/10/2026 23:15:28 UTC	TCP	9200 · ELASTICSEARCH	elasticsearch	Sonde Elasticsearch elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)	Élevée	Faible · 22
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / Requête Elasticsearch : / UA Go-http-client/1.1 Émulateur ELASTICSEARCH WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_ua_suspicious net_elasticsearch_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9200 Chemin / cible / Service ELASTICSEARCH Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 0% Confiance classification 0% Risque capteur Faible · 22 Confiance : Confiance 0 % — 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"http_header_count":3,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"d19a1b8472adabca1ee6e310101ca46b45ece34e","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":96,"payload_entropy":4.918426699477594,"port_category":"registered","org":"DigitalOcean, LLC","service":"elasticsearch","app_proto":"elasticsearch","asn":14061,"country":"US","dst_port":9200,"risk_waf":20,"risk_classification":58,"risk_behavior":0,"risk_geo":40,"risk_protocol":50,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":20,"classification":58,"behavior":0,"geo":40,"protocol":50,"novelty":15},"risk_score":22,"tag_count":3,"anomaly_count":0,"campaign_key":"f5c706d584f258613df0890f290076064d9813ba","event_fingerprint":"51cd5383980c299a7513ab00aa13577eca9d42fc","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_b…
22/10/2026 23:15:28 UTC	TCP	9200 · ELASTICSEARCH	elasticsearch	Sonde Elasticsearch probe elastic · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET /_cat/indices Requête Elasticsearch : /_cat/indices?format=json UA Go-http-client/1.1 Émulateur ELASTICSEARCH WAF 10 Recommandation Surveiller Tags 950468:nosqli-3 950607:elastic-cat http_probe_elastic http_ua_suspicious Cible HTTP GET /_cat/indices TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9200 Chemin / cible /_cat/indices Service ELASTICSEARCH Pourquoi cette classification : Tags WAF: nosqli-3, elastic-cat · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — 2 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET /_cat/indices?format=json HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF nosqli-3 elastic-cat Payload (extrait) GET /_cat/indices?format=json HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"http_header_count":3,"http_query_params":1,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"d19a1b8472adabca1ee6e310101ca46b45ece34e","http_target_hash":"370cae99942aa27e42f71117e2dde07013b646f5","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":116,"payload_entropy":5.034790160917155,"port_category":"registered","org":"DigitalOcean, LLC","service":"elasticsearch","app_proto":"elasticsearch","asn":14061,"country":"US","dst_port":9200,"risk_waf":48,"risk_classification":48,"risk_behavior":0,"risk_geo":40,"risk_protocol":50,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":48,"classification":48,"behavior":0,"geo":40,"protocol":50,"novelty":25},"risk_score":45,"tag_count":5,"anomaly_count":0,"campaign_key":"b314e05ccaca9d318cb7e51d317b528fa9c1a295","event_fingerprint":"ed23d7883983626253e3ecc0bfe647d76c8ba300","classification_reason":"Tags WAF: nosqli-3, elastic-cat \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf…
22/10/2026 23:15:27 UTC	TCP	9200 · ELASTICSEARCH	elasticsearch	Sonde Elasticsearch elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cluster/health	Élevée	Faible · 26
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET /_cluster/health Requête Elasticsearch : /_cluster/health?pretty UA Go-http-client/1.1 Émulateur ELASTICSEARCH WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_ua_suspicious net_elasticsearch_probe Cible HTTP GET /_cluster/health TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9200 Chemin / cible /_cluster/health Service ELASTICSEARCH Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 0% Confiance classification 0% Risque capteur Faible · 26 Confiance : Confiance 0 % — 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET /_cluster/health?pretty HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF nosqli-3 Payload (extrait) GET /_cluster/health?pretty HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"http_header_count":3,"http_query_params":1,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"d19a1b8472adabca1ee6e310101ca46b45ece34e","http_target_hash":"53bde7c84dc4dc98126ef993b7b218052b711371","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":114,"payload_entropy":4.960903621107942,"port_category":"registered","org":"DigitalOcean, LLC","service":"elasticsearch","app_proto":"elasticsearch","asn":14061,"country":"US","dst_port":9200,"risk_waf":32,"risk_classification":58,"risk_behavior":0,"risk_geo":40,"risk_protocol":50,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":32,"classification":58,"behavior":0,"geo":40,"protocol":50,"novelty":15},"risk_score":26,"tag_count":3,"anomaly_count":0,"campaign_key":"91d2e7506a9875f0debdfdad206687c85bb79c1f","event_fingerprint":"d5d9e95d93081a1c53ae48aba60dbed362b00ae8","classification_reason":"Tags WAF: nosqli-3 \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":…
22/10/2026 23:15:27 UTC	TCP	9200 · ELASTICSEARCH	elasticsearch	Sonde Elasticsearch elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)	Élevée	Faible · 22
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / Requête Elasticsearch : /?pretty UA Go-http-client/1.1 Émulateur ELASTICSEARCH WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_ua_suspicious net_elasticsearch_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9200 Chemin / cible / Service ELASTICSEARCH Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 0% Confiance classification 0% Risque capteur Faible · 22 Confiance : Confiance 0 % — 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET /?pretty HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF sap-sapcontrol-path Payload (extrait) GET /?pretty HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"http_header_count":3,"http_query_params":1,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"d19a1b8472adabca1ee6e310101ca46b45ece34e","http_target_hash":"e3801637f4e20ff756436cae7ea6a14f0a14f884","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":99,"payload_entropy":4.887418939614036,"port_category":"registered","org":"DigitalOcean, LLC","service":"elasticsearch","app_proto":"elasticsearch","asn":14061,"country":"US","dst_port":9200,"risk_waf":20,"risk_classification":58,"risk_behavior":0,"risk_geo":40,"risk_protocol":50,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":20,"classification":58,"behavior":0,"geo":40,"protocol":50,"novelty":15},"risk_score":22,"tag_count":3,"anomaly_count":0,"campaign_key":"f5c706d584f258613df0890f290076064d9813ba","event_fingerprint":"098920f5126a62ee13d43b53d4ee5ea90d49db9d","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_b…
22/10/2026 23:15:27 UTC	TCP	9200 · ELASTICSEARCH	elasticsearch	Sonde SAP Diag/GUI Sonde SAP Diag/GUI · via ELASTICSEARCH:9200 · (sonde / probe) · → /query	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET /query Requête Elasticsearch : /query?q=SHOW+DIAGNOSTICS UA Go-http-client/1.1 Émulateur ELASTICSEARCH WAF 0 Recommandation Surveiller Tags http_ua_suspicious net_sap_diag_probe Cible HTTP GET /query TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9200 Chemin / cible /query Service ELASTICSEARCH Pourquoi cette classification : Type « Sonde SAP Diag/GUI » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"http_header_count":3,"http_query_params":1,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"c3e68bb8f388240c7ecaebb8bcb80a85536526f2","http_host_hash":"d19a1b8472adabca1ee6e310101ca46b45ece34e","http_target_hash":"148d0a7b9fa867b9eb3d978e0caa495e68940f78","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":116,"payload_entropy":5.259089785000451,"port_category":"registered","org":"DigitalOcean, LLC","service":"elasticsearch","app_proto":"elasticsearch","asn":14061,"country":"US","dst_port":9200,"risk_waf":8,"risk_classification":62,"risk_behavior":0,"risk_geo":40,"risk_protocol":50,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.5,"risk_breakdown":{"waf":8,"classification":62,"behavior":0,"geo":40,"protocol":50,"novelty":15},"risk_score":24,"tag_count":2,"anomaly_count":0,"campaign_key":"42df2c82fa1062d5d23aece3a9eebe9dec615be6","event_fingerprint":"e958f05f1535baf4af8ec4c9d5a6e0cfb5437307","classification_reason":"Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb…
22/10/2026 17:07:07 UTC	TCP	9093 · KAFKA CONTROLLER	kafka-controller	Sonde contrôleur Kafka kafka-controller · via KAFKA CONTROLLER:9093 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur KAFKA-CONTROLLER WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9093 Chemin / cible — Service KAFKA CONTROLLER Payload $ ۤ��0�A�3;��K!%X�Y^�.k�� X�Q$�ьkc��]��?`��u�X(Õ��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Pourquoi cette classification : Type « Sonde contrôleur Kafka » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 1 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) $ ۤ��0�A�3;��K!%X�Y^�.k�� X�Q$�ьkc��]��?`��u�X(Õ��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Requête brute (extrait) $ ۤ��0�A�3;��K!%X�Y^�.k�� X�Q$�ьkc��]��?`��u�X(Õ��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/�� # *( + - Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a","emulator_response_len":47,"bytes_in":297,"payload_entropy":5.759205315621041,"port_category":"registered","org":"DigitalOcean, LLC","service":"kafka-controller","app_proto":"kafka-controller","asn":14061,"country":"US","dst_port":9093,"risk_waf":8,"risk_classification":24,"risk_behavior":0,"risk_geo":40,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":40,"protocol":30,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"a071e2df433513002c4a033e66fe8ce9adf68396","event_fingerprint":"5e86e7ef7317f197e3a55fdab091d110850a32e6","classification_reason":"Type \u00ab kafka-controller \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":40,"protocol":30,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"kafka-controller","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"payload_hash":"17f1c1b150a3ed4757ce6ae488d94d38","path_pattern_hash":"bdd83a591b819eaddba50799a531ed9f"},"target_co…
22/10/2026 17:07:07 UTC	TCP	9093 · KAFKA CONTROLLER	kafka-controller	Sonde Solr solr probe · via KAFKA CONTROLLER:9093 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1595 Découverte Accès Protocole Émulateur KAFKA-CONTROLLER WAF — Recommandation Surveiller Tags http_get_probe solr_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9093 Chemin / cible — Service KAFKA CONTROLLER Payload GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1 Host: 62.3.50.33:9093 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Type « Sonde Solr » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Faible · 38 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Console admin Apache Solr Upstream Technique MITRE T1595 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1 Host: 62.3.50.33:9093 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a","emulator_response_len":47,"bytes_in":130,"payload_entropy":5.075590729573204,"port_category":"registered","org":"DigitalOcean, LLC","service":"kafka-controller","app_proto":"kafka-controller","asn":14061,"country":"US","dst_port":9093,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":40,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":32,"novelty":15},"risk_score":38,"tag_count":2,"anomaly_count":0,"campaign_key":"ae81f554e5170edb685f12a3c79583bc80b2ce16","event_fingerprint":"5e86e7ef7317f197e3a55fdab091d110850a32e6","classification_reason":"Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":93,"precision_signals":["INT-SEC-solr-admin","INT-upstream"],"kb_rule_ids":["INT-SEC-solr-admin","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":32,"novelty":15,"risk_score":38},"named_classification_skipped":false,"service_name":"kafka-controller","risk_confidence_factor":95,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"payload_hash":"56660ed6a3014c2aa11f506df…
22/10/2026 17:07:06 UTC	TCP	9093 · KAFKA CONTROLLER	kafka-controller	Sonde contrôleur Kafka kafka-controller · via KAFKA CONTROLLER:9093 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole JA3 d6828e30ab66774a Émulateur KAFKA-CONTROLLER WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9093 Chemin / cible — Service KAFKA CONTROLLER Payload ��,>Ax�0�}�H5��n��P��{��j �-�VQ��J�[�s��b�-QK90Fz��&&�+�/�,�0̨̩� �� /5� { Pourquoi cette classification : Type « Sonde contrôleur Kafka » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 1 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) ��,>Ax�0�}�H5��n��P��{��j �-�VQ��J�[�s��b�-QK90Fz��&&�+�/�,�0̨̩� �� /5� { Requête brute (extrait) ��,>Ax�0�}�H5��n��P��{��j �-�VQ��J�[�s��b�-QK90Fz��&&�+�/�,�0̨̩� �� /5� { �+3&$ � ��!�7�}�9��U{��W��cƝ�/ Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a","emulator_response_len":47,"bytes_in":243,"payload_entropy":5.729083530644887,"port_category":"registered","org":"DigitalOcean, LLC","service":"kafka-controller","app_proto":"kafka-controller","asn":14061,"country":"US","dst_port":9093,"risk_waf":8,"risk_classification":24,"risk_behavior":0,"risk_geo":40,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":40,"protocol":30,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"a071e2df433513002c4a033e66fe8ce9adf68396","event_fingerprint":"5e86e7ef7317f197e3a55fdab091d110850a32e6","classification_reason":"Type \u00ab kafka-controller \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":40,"protocol":30,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"kafka-controller","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"payload_hash":"b6c6e630ee672b1c4a67b8a49f73ef88","path_pattern_hash":"bdd83a591b819eaddba50799a531ed9f","ja3":"d682…
22/10/2026 17:07:06 UTC	TCP	9093 · KAFKA CONTROLLER	kafka-controller	Sonde contrôleur Kafka kafka-controller · via KAFKA CONTROLLER:9093 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole JA3 d6828e30ab66774a Émulateur KAFKA-CONTROLLER WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9093 Chemin / cible — Service KAFKA CONTROLLER Payload ��]��n�h��i� �n��5��O�� +�"L�Y��>Qh-��ekە��8C&�+�/�,�0̨̩� �� /5� { Pourquoi cette classification : Type « Sonde contrôleur Kafka » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 1 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) ��]��n�h��i� �n��5��O�� +�"L�Y��>Qh-��ekە��8C&�+�/�,�0̨̩� �� /5� { Requête brute (extrait) ��]��n�h��i� �n��5��O�� +�"L�Y��>Qh-��ekە��8C&�+�/�,�0̨̩� �� /5� { �+3&$ �{E=�Pl��V�x�p�Y� [��'E Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a","emulator_response_len":47,"bytes_in":243,"payload_entropy":5.802508341041116,"port_category":"registered","org":"DigitalOcean, LLC","service":"kafka-controller","app_proto":"kafka-controller","asn":14061,"country":"US","dst_port":9093,"risk_waf":8,"risk_classification":24,"risk_behavior":0,"risk_geo":40,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":40,"protocol":30,"novelty":15},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"a071e2df433513002c4a033e66fe8ce9adf68396","event_fingerprint":"5e86e7ef7317f197e3a55fdab091d110850a32e6","classification_reason":"Type \u00ab kafka-controller \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":40,"protocol":30,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"kafka-controller","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"payload_hash":"56b2c0bbde0768bf63d8ff60da03e40d","path_pattern_hash":"bdd83a591b819eaddba50799a531ed9f","ja3":"d682…
22/10/2026 17:07:06 UTC	TCP	9093 · KAFKA CONTROLLER	kafka-controller	Sonde Solr solr probe · via KAFKA CONTROLLER:9093 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1595 Découverte Accès Protocole Émulateur KAFKA-CONTROLLER WAF — Recommandation Surveiller Tags http_get_probe solr_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9093 Chemin / cible — Service KAFKA CONTROLLER Payload GET /solr/admin/info/system HTTP/1.1 Host: 62.3.50.33:9093 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Type « Sonde Solr » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Faible · 38 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Console admin Apache Solr Upstream Technique MITRE T1595 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET /solr/admin/info/system HTTP/1.1 Host: 62.3.50.33:9093 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206b61666b615f636f6e74726f6c6c657220726561647920706f72743d393039330d0a","emulator_response_len":47,"bytes_in":114,"payload_entropy":4.9474348362472735,"port_category":"registered","org":"DigitalOcean, LLC","service":"kafka-controller","app_proto":"kafka-controller","asn":14061,"country":"US","dst_port":9093,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":40,"risk_protocol":32,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":32,"novelty":15},"risk_score":38,"tag_count":2,"anomaly_count":0,"campaign_key":"ae81f554e5170edb685f12a3c79583bc80b2ce16","event_fingerprint":"5e86e7ef7317f197e3a55fdab091d110850a32e6","classification_reason":"Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":93,"precision_signals":["INT-SEC-solr-admin","INT-upstream"],"kb_rule_ids":["INT-SEC-solr-admin","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":32,"novelty":15,"risk_score":38},"named_classification_skipped":false,"service_name":"kafka-controller","risk_confidence_factor":95,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"payload_hash":"f8688fb4b3fa680ba144f074…
22/10/2026 16:21:03 UTC	TCP	1433 · MSSQL	mssql	Sonde SAP Diag/GUI Sonde SAP Diag/GUI · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags http_get_probe mssql_emulated mssql_payload net_sap_diag_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"001f00001a00060000000000000000000000000000000000000000000000000000","emulator_response_len":33,"bytes_in":116,"payload_entropy":5.227111285478496,"port_category":"registered","org":"DigitalOcean, LLC","service":"mssql","app_proto":"mssql","asn":14061,"country":"US","dst_port":1433,"risk_waf":8,"risk_classification":62,"risk_behavior":0,"risk_geo":40,"risk_protocol":46,"risk_novelty":25,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":62,"behavior":0,"geo":40,"protocol":46,"novelty":25},"risk_score":24,"tag_count":5,"anomaly_count":0,"campaign_key":"23c48d525e6b81dc936a8bacf1bfaf0d5f1dd02a","event_fingerprint":"a06b45218f0653610947000d9772c1e90ba2e6d3","classification_reason":"Connexion SAP Diag\/GUI \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":62,"behavior":0,"geo":40,"protocol":46,"novelty":25,"risk_score":24},"named_classification_skipped":false,"service_name":"mssql","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"payload_hash":"7b63db9df1d1a42ed51a4c25b971a8b0","path_pattern_hash":"b1c7373ffa4daadb6ab138f759082d87"},"target_context":{"dst_port":1433,"service":"mssql","service_name":"mssql","risk_score":24},"payload_prev…
22/10/2026 16:21:03 UTC	TCP	1433 · MSSQL	mssql	Protocole TDS MSSQL mssql tds · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags mssql_emulated mssql_payload mssql_probe mssql_tds Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload / !"&�� Pourquoi cette classification : Type « Protocole TDS MSSQL » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Faible · 35 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Upstream Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) MSSQL TDS prelogin Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) / !"&�� Meta JSON brut {"protocol_emulated":true,"emulator_response":"001f00001a00060000000000000000000000000000000000000000000000000000","emulator_response_len":33,"bytes_in":47,"payload_entropy":2.4483845318297544,"port_category":"registered","org":"DigitalOcean, LLC","service":"mssql","app_proto":"mssql","asn":14061,"country":"US","dst_port":1433,"risk_waf":8,"risk_classification":56,"risk_behavior":0,"risk_geo":40,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":40,"protocol":36,"novelty":10},"risk_score":35,"tag_count":5,"anomaly_count":0,"campaign_key":"584dc8ab43572550a5af46f03637ac724e8c86c3","event_fingerprint":"24635733bde8ab881cad2aa5e51b4b5bf5e45e9f","classification_reason":"Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":83,"precision_signals":["pat-0519","INT-upstream"],"kb_rule_ids":["pat-0519","INT-upstream"],"matched_patterns":["pat-0519","pat-0768","pat-0554","pat-0536"],"matched_pattern_names":["MSSQL TDS prelogin","Mumble ping","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0519","pat-0768","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":40,"protocol":36,"novelty":10,"risk_score":35},"named_classification_skipped":false,"service_name":"mssql","risk_confidence_factor":95,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"countr…
22/10/2026 14:50:03 UTC	TCP	8983 · TLS	tls	Sonde TLS tls probe · via TLS:8983 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole JA3 c216e752cae6f875 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8983 Chemin / cible — Service TLS Payload $ ��x>��~glP2VN��`��?�.㯦�E u��܄:�+Hֆ{��[p��kmGK�KKEk>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Pourquoi cette classification : Type « Sonde TLS » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) $ ��x>��~glP2VN��`��?�.㯦�E u��܄:�+Hֆ{��[p��kmGK�KKEk>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Requête brute (extrait) $ ��x>��~glP2VN��`��?�.㯦�E u��܄:�+Hֆ{��[p��kmGK�KKEk>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/�� # *( + - Meta JSON brut {"tls_ja3_hash":"c216e752cae6f8755fd27f561d031636","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":8,"bytes_in":297,"payload_entropy":5.814643183637696,"port_category":"registered","org":"DigitalOcean, LLC","service":"tls","app_proto":"tls","asn":14061,"country":"US","dst_port":8983,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":4.9,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15},"risk_score":35,"tag_count":3,"anomaly_count":0,"campaign_key":"b744e7718f152490960997d02e191b41068d5ebf","event_fingerprint":"506fd040c8ab2290e460c3acf1965f87d48d997e","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15,"risk_score":35,"correlation_boost":8},"service_name":"tls","risk_confidence_factor":50,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":14061,"org":"DigitalOcean, LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"ja3":"c216e752cae6f8755fd27f561d031636","payload_hash":"215957d7371833f4ab7e9b66aa6fe45a","path_pattern_hash":"8792d2cfdc5028123bfb8f159de8656c"},"target_context":{"dst_port":8983,"service":"tls","service_name":"tls","risk_score":35},"payload_snipp…

198.211.109.144

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence