{"ip":"198.98.54.65","exported_at":"2026-07-21T21:38:05+00:00","period_days":30,"metrics":{"events7d":1,"distinct_ports":1,"distinct_classifications":1,"max_severity":5,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":45,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["scanner"],"recommended_action":"monitor","confidence":0.5,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":11,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 45\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":45},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":50,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0554"],"tags_summary":["pat-0554"],"attack_vector":"sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j]\u001fiAz\u0011\ufffd\ufffd\ufffd\ufffd\u00103\ufffd\ufffd\ufffdI,\\X\u001fZD\ufffd\ufffd\ufffd\u001fv:p\ufffd\ufffd\u0000\u00004\ufffd(\ufffd\u0027\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00009\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000\u003C\u00005\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\n\ufffd\t\u0000j\u0000@\u00008\u00002\u0000\n\u0000\u0013\u0001\u0000\u00005\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0006\u0001\u0006\u0003","tls_ja3":"1f587d8031d98b69da197bc38f8ca923","tls_ja4":"2e581b50149a6d0d8f3d93e85ed97b6a","port":5061,"service":"sip-tls","service_label_fr":"SIP TLS"},"protocol_summary_fr":"JA3 1f587d8031d98b69 \u00b7 Payload \u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j]\u001fiAz\u0011\ufffd\ufffd\ufffd\ufffd\u00103\ufffd\ufffd\ufffdI,\\X\u001fZD\ufffd\ufffd\ufffd\u001fv:p\ufffd\ufffd\u0000\u00004\ufffd(\ufffd\u0027\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00009\u00003\u0000\u2026 \u00b7 SIP TLS:5061","evidence_snippet":"\ufffd\ufffdj]iAz\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdI,\\XZD\ufffd\ufffd\ufffdv:p\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\n\ufffd\tj@82\n5","target_port_label":"5061 \u00b7 SIP TLS","emulator_service":"sip-tls","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 50 % \u2014 Score WAF 8","payload_preview":"\ufffd\ufffdj]iAz\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdI,\\XZD\ufffd\ufffd\ufffdv:p\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\n\ufffd\tj@82\n5"},"events":[{"id":12893757,"ip":"198.98.54.65","ts":"2026-07-19 19:02:59.000000","proto":"tcp","src_port":54766,"dst_port":5061,"service":"sip-tls","classification":"sip_voip_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.935123578166803, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022sip-tls\u0022, \u0022app_proto\u0022: \u0022sip-tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5061, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 50.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022554e11b9302bdfcd540c45a1cf923952ca5dba5a\u0022, \u0022event_fingerprint\u0022: \u0022023bc9d1c35abdce99228ec210a0d9707a172294\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022service_name\u0022: \u0022sip-tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00221de1afec21037f6606f8f230c2234555\u0022, \u0022path_pattern_hash\u0022: \u002212e58fcb9ae07c2755694e8888ea070c\u0022, \u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5061, \u0022service\u0022: \u0022sip-tls\u0022, \u0022service_name\u0022: \u0022sip-tls\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j]\\u001fiAz\\u0011\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\ufffd\ufffdI,\\\\X\\u001fZD\ufffd\ufffd\ufffd\\u001fv:p\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j]\\u001fiAz\\u0011\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\ufffd\ufffdI,\\\\X\\u001fZD\ufffd\ufffd\ufffd\\u001fv:p\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j]\\u001fiAz\\u0011\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\ufffd\ufffdI,\\\\X\\u001fZD\ufffd\ufffd\ufffd\\u001fv:p\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f6a7d1b37c963b8161b73251ec090276fccce83b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j]\\u001fiAz\\u0011\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\ufffd\ufffdI,\\\\X\\u001fZD\ufffd\ufffd\ufffd\\u001fv:p\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5061, \u0022service\u0022: \u0022sip-tls\u0022, \u0022service_label_fr\u0022: \u0022SIP TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj]iAz\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdI,\\\\XZD\ufffd\ufffd\ufffdv:p\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225061 \u00b7 SIP TLS\u0022, \u0022emulator_service\u0022: \u0022sip-tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab sip_voip_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022sip-tls\u0022, \u0022service_label_fr\u0022: \u0022SIP TLS\u0022, \u0022dst_port\u0022: 5061, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-sip-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j]\\u001fiAz\\u0011\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\ufffd\ufffdI,\\\\X\\u001fZD\ufffd\ufffd\ufffd\\u001fv:p\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5061, \u0022service\u0022: \u0022sip-tls\u0022, \u0022service_label_fr\u0022: \u0022SIP TLS\u0022}, \u0022attack_vector\u0022: \u0022sip voip probe \u00b7 via SIP TLS:5061 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj]iAz\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdI,\\\\XZD\ufffd\ufffd\ufffdv:p\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225061 \u00b7 SIP TLS\u0022, \u0022emulator_service\u0022: \u0022sip-tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022sip_tls\u0022, \u0022service_banner\u0022: \u0022honeypot-sip-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225061\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_sip_voip_probe\u0022, \u0022sip_tls_emulated\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_sip_voip_probe\u0022, \u0022sip_tls_emulated\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":155},{"id":11693207,"ip":"198.98.54.65","ts":"2026-07-13 14:14:55.000000","proto":"tcp","src_port":53195,"dst_port":5066,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 12, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.91735011041091, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5066, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 3.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220d3174bb3ca9bb638f8de00faf854c8540efc70d\u0022, \u0022event_fingerprint\u0022: \u0022817bec670c42dd3133784c896a78a690faa76dcd\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022payload_hash\u0022: \u0022103573d0a0decc40e116ccddeb0b7914\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5066, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd\ufffd\ufffd\ufffd\ufffdTm\ufffd\ufffdl\ufffdY\ufffd)\ufffdiQ\ufffd\ufffd\ufffd\\u0012ET\ufffdaV\ufffd\ufffd\\u0013\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd\ufffd\ufffd\ufffd\ufffdTm\ufffd\ufffdl\ufffdY\ufffd)\ufffdiQ\ufffd\ufffd\ufffd\\u0012ET\ufffdaV\ufffd\ufffd\\u0013\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd\ufffd\ufffd\ufffd\ufffdTm\ufffd\ufffdl\ufffdY\ufffd)\ufffdiQ\ufffd\ufffd\ufffd\\u0012ET\ufffdaV\ufffd\ufffd\\u0013\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002214e0d88f37097cb251f90afa8419fb9583e81aad\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd\ufffd\ufffd\ufffd\ufffdTm\ufffd\ufffdl\ufffdY\ufffd)\ufffdiQ\ufffd\ufffd\ufffd\\u0012ET\ufffdaV\ufffd\ufffd\\u0013\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5066, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT\ufffd\ufffd\ufffd\ufffd\ufffdTm\ufffd\ufffdl\ufffdY\ufffd)\ufffdiQ\ufffd\ufffd\ufffdET\ufffdaV\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5066 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225066 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5066, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd\ufffd\ufffd\ufffd\ufffdTm\ufffd\ufffdl\ufffdY\ufffd)\ufffdiQ\ufffd\ufffd\ufffd\\u0012ET\ufffdaV\ufffd\ufffd\\u0013\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5066, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5066 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT\ufffd\ufffd\ufffd\ufffd\ufffdTm\ufffd\ufffdl\ufffdY\ufffd)\ufffdiQ\ufffd\ufffd\ufffdET\ufffdaV\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225066 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225066\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"1f587d8031d98b69da197bc38f8ca923","tls_ja3":"771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":155},{"id":11689110,"ip":"198.98.54.65","ts":"2026-07-13 13:41:54.000000","proto":"tcp","src_port":53612,"dst_port":5065,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 12, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.914187368503342, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5065, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002254fe5cb0deb0f802881829c1c70638432a7364b9\u0022, \u0022event_fingerprint\u0022: \u00228d994fb48336ddf7f45d47010142e95badd38b88\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022payload_hash\u0022: \u0022fca1d9c24fcce85cf7a61316dab2301c\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5065, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd$\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\\r\\u0016tz)\ufffd\ufffd\ufffd\\u0019\ufffd\ufffd\ufffdT\ufffd\ufffd\u0027\ufffd\/\ufffd6\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd$\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\\r\\u0016tz)\ufffd\ufffd\ufffd\\u0019\ufffd\ufffd\ufffdT\ufffd\ufffd\u0027\ufffd\/\ufffd6\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd$\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\\r\\u0016tz)\ufffd\ufffd\ufffd\\u0019\ufffd\ufffd\ufffdT\ufffd\ufffd\u0027\ufffd\/\ufffd6\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002290fabc9a8fafc1345688bf6817d804e9be4bb30c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd$\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\\r\\u0016tz)\ufffd\ufffd\ufffd\\u0019\ufffd\ufffd\ufffdT\ufffd\ufffd\u0027\ufffd\/\ufffd6\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5065, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT\ufffd$\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\\rtz)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\u0027\ufffd\/\ufffd64\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5065 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225065 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5065, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffd$\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\\r\\u0016tz)\ufffd\ufffd\ufffd\\u0019\ufffd\ufffd\ufffdT\ufffd\ufffd\u0027\ufffd\/\ufffd6\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5065, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5065 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT\ufffd$\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd\\rtz)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\u0027\ufffd\/\ufffd64\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225065 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225065\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"1f587d8031d98b69da197bc38f8ca923","tls_ja3":"771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":155},{"id":11627727,"ip":"198.98.54.65","ts":"2026-07-13 08:44:05.000000","proto":"tcp","src_port":59174,"dst_port":5064,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 12, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.888380916890438, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5064, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022971082e069b3eb4dade1a3bc00648283e73a51ca\u0022, \u0022event_fingerprint\u0022: \u0022550df782fe80a4148844082195bbba879c9affd9\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022payload_hash\u0022: \u00220a0b0d22ad23bc7723e4dc5be478e40e\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5064, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffdW\ufffd\ufffdVl\ufffdC*9W\\r\ufffdXI\ufffd\ufffd\ufffdCb\ufffd8)~T:\\u001c\ufffdb\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffdW\ufffd\ufffdVl\ufffdC*9W\\r\ufffdXI\ufffd\ufffd\ufffdCb\ufffd8)~T:\\u001c\ufffdb\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffdW\ufffd\ufffdVl\ufffdC*9W\\r\ufffdXI\ufffd\ufffd\ufffdCb\ufffd8)~T:\\u001c\ufffdb\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dd93adca9975b4840b482acbb10d56b34484f7f9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffdW\ufffd\ufffdVl\ufffdC*9W\\r\ufffdXI\ufffd\ufffd\ufffdCb\ufffd8)~T:\\u001c\ufffdb\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5064, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT\ufffdW\ufffd\ufffdVl\ufffdC*9W\\r\ufffdXI\ufffd\ufffd\ufffdCb\ufffd8)~T:\ufffdb4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5064 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225064 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5064, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT\ufffdW\ufffd\ufffdVl\ufffdC*9W\\r\ufffdXI\ufffd\ufffd\ufffdCb\ufffd8)~T:\\u001c\ufffdb\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5064, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5064 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT\ufffdW\ufffd\ufffdVl\ufffdC*9W\\r\ufffdXI\ufffd\ufffd\ufffdCb\ufffd8)~T:\ufffdb4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225064 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225064\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"1f587d8031d98b69da197bc38f8ca923","tls_ja3":"771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":155},{"id":11595148,"ip":"198.98.54.65","ts":"2026-07-13 05:56:15.000000","proto":"tcp","src_port":60565,"dst_port":5062,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 12, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.8375963833153675, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5062, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223e0ab3b51f8f1177ae737ac628a22f1158fbc9a2\u0022, \u0022event_fingerprint\u0022: \u0022a0c06241df0d74d276e8cf1d7aad453151a2f7cc\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022payload_hash\u0022: \u002212b40520bf528d6b50264e2111d97821\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5062, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT~\\u0000\\u00059+\ufffd\\u0017\\u000e\ufffdN[9m\ufffd2\ufffd?\ufffd\ufffdn\ufffd\\u001d\ufffdY\ufffd}\ufffd\\u0014\\u001f\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT~\\u0000\\u00059+\ufffd\\u0017\\u000e\ufffdN[9m\ufffd2\ufffd?\ufffd\ufffdn\ufffd\\u001d\ufffdY\ufffd}\ufffd\\u0014\\u001f\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT~\\u0000\\u00059+\ufffd\\u0017\\u000e\ufffdN[9m\ufffd2\ufffd?\ufffd\ufffdn\ufffd\\u001d\ufffdY\ufffd}\ufffd\\u0014\\u001f\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002218c9d00ee6bafc51b7d4c0fc7682ec0f69a25425\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT~\\u0000\\u00059+\ufffd\\u0017\\u000e\ufffdN[9m\ufffd2\ufffd?\ufffd\ufffdn\ufffd\\u001d\ufffdY\ufffd}\ufffd\\u0014\\u001f\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5062, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT~9+\ufffd\ufffdN[9m\ufffd2\ufffd?\ufffd\ufffdn\ufffd\ufffdY\ufffd}\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5062 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225062 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5062, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT~\\u0000\\u00059+\ufffd\\u0017\\u000e\ufffdN[9m\ufffd2\ufffd?\ufffd\ufffdn\ufffd\\u001d\ufffdY\ufffd}\ufffd\\u0014\\u001f\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5062, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5062 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT~9+\ufffd\ufffdN[9m\ufffd2\ufffd?\ufffd\ufffdn\ufffd\ufffdY\ufffd}\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225062 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225062\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"1f587d8031d98b69da197bc38f8ca923","tls_ja3":"771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":155},{"id":11556779,"ip":"198.98.54.65","ts":"2026-07-13 03:30:04.000000","proto":"tcp","src_port":58419,"dst_port":5069,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 12, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.94948204583895, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5069, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b120e6ec3a3ccf152c018c0c2baae2dd8c90f482\u0022, \u0022event_fingerprint\u0022: \u0022dda9d70037a2509cf6a12f35a2ff98e8a81ab3dc\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022payload_hash\u0022: \u00220b970fac3666580f629b095c19b16797\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5069, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT[\ufffd\ufffd\uaae2\ufffdF\u033c\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd*\\u0010\\u0016\ufffd\ufffd\ufffd\\u001dl\ufffd`\ufffdt\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT[\ufffd\ufffd\uaae2\ufffdF\u033c\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd*\\u0010\\u0016\ufffd\ufffd\ufffd\\u001dl\ufffd`\ufffdt\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT[\ufffd\ufffd\uaae2\ufffdF\u033c\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd*\\u0010\\u0016\ufffd\ufffd\ufffd\\u001dl\ufffd`\ufffdt\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c2b8d624dfa1ace1657f0caf19e21966e8dddeb1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT[\ufffd\ufffd\uaae2\ufffdF\u033c\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd*\\u0010\\u0016\ufffd\ufffd\ufffd\\u001dl\ufffd`\ufffdt\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5069, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT[\ufffd\ufffd\uaae2\ufffdF\u033c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdl\ufffd`\ufffdt\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225069 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5069, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jT[\ufffd\ufffd\uaae2\ufffdF\u033c\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd*\\u0010\\u0016\ufffd\ufffd\ufffd\\u001dl\ufffd`\ufffdt\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5069, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjT[\ufffd\ufffd\uaae2\ufffdF\u033c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdl\ufffd`\ufffdt\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225069 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225069\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"1f587d8031d98b69da197bc38f8ca923","tls_ja3":"771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":155},{"id":11424500,"ip":"198.98.54.65","ts":"2026-07-12 14:06:59.000000","proto":"tcp","src_port":52749,"dst_port":5063,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 12, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.891962572128786, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5063, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 2.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022371256f15f9026e1429cee92f242dc51ae5ae2e5\u0022, \u0022event_fingerprint\u0022: \u0022a608d8edbc5cb38e281d498e914a72e017a39cbd\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022payload_hash\u0022: \u002210d9b38762003b27b88b237853abca51\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5063, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jS\ufffd\ufffd\ufffd\\u001cF\ufffd_\\u001c\ufffd]b\u0644\ufffd\ufffd\ufffd\ufffd)\u076c3\\t\ufffdf\ufffd~\\u0001\\u000ex\\u0017\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jS\ufffd\ufffd\ufffd\\u001cF\ufffd_\\u001c\ufffd]b\u0644\ufffd\ufffd\ufffd\ufffd)\u076c3\\t\ufffdf\ufffd~\\u0001\\u000ex\\u0017\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jS\ufffd\ufffd\ufffd\\u001cF\ufffd_\\u001c\ufffd]b\u0644\ufffd\ufffd\ufffd\ufffd)\u076c3\\t\ufffdf\ufffd~\\u0001\\u000ex\\u0017\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002244434a8ae7ad86067b1744ad8c94af1007deafcf\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jS\ufffd\ufffd\ufffd\\u001cF\ufffd_\\u001c\ufffd]b\u0644\ufffd\ufffd\ufffd\ufffd)\u076c3\\t\ufffdf\ufffd~\\u0001\\u000ex\\u0017\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5063, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjS\ufffd\ufffd\ufffdF\ufffd_\ufffd]b\u0644\ufffd\ufffd\ufffd\ufffd)\u076c3\\t\ufffdf\ufffd~x4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5063 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225063 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5063, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jS\ufffd\ufffd\ufffd\\u001cF\ufffd_\\u001c\ufffd]b\u0644\ufffd\ufffd\ufffd\ufffd)\u076c3\\t\ufffdf\ufffd~\\u0001\\u000ex\\u0017\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5063, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5063 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjS\ufffd\ufffd\ufffdF\ufffd_\ufffd]b\u0644\ufffd\ufffd\ufffd\ufffd)\u076c3\\t\ufffdf\ufffd~x4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225063 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225063\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"1f587d8031d98b69da197bc38f8ca923","tls_ja3":"771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":155},{"id":11228139,"ip":"198.98.54.65","ts":"2026-07-11 20:19:04.000000","proto":"tcp","src_port":55285,"dst_port":5062,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 12, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.831645513539011, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5062, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223e0ab3b51f8f1177ae737ac628a22f1158fbc9a2\u0022, \u0022event_fingerprint\u0022: \u0022a0c06241df0d74d276e8cf1d7aad453151a2f7cc\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022payload_hash\u0022: \u00226e9ecabfce679fee15ce0f545b814582\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5062, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jR\ufffd9\ufffdl\ufffd\\u00034\\u0014$x9A\ufffdk \ufffdug3\ufffd\u05e3\u9436\\u000e$A\ufffdu\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jR\ufffd9\ufffdl\ufffd\\u00034\\u0014$x9A\ufffdk \ufffdug3\ufffd\u05e3\u9436\\u000e$A\ufffdu\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jR\ufffd9\ufffdl\ufffd\\u00034\\u0014$x9A\ufffdk \ufffdug3\ufffd\u05e3\u9436\\u000e$A\ufffdu\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222b56b069347a3946d7794f5e8af2a439eca7ff11\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jR\ufffd9\ufffdl\ufffd\\u00034\\u0014$x9A\ufffdk \ufffdug3\ufffd\u05e3\u9436\\u000e$A\ufffdu\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5062, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjR\ufffd9\ufffdl\ufffd4$x9A\ufffdk \ufffdug3\ufffd\u05e3\u9436$A\ufffdu4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5062 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225062 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5062, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jR\ufffd9\ufffdl\ufffd\\u00034\\u0014$x9A\ufffdk \ufffdug3\ufffd\u05e3\u9436\\u000e$A\ufffdu\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5062, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5062 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjR\ufffd9\ufffdl\ufffd4$x9A\ufffdk \ufffdug3\ufffd\u05e3\u9436$A\ufffdu4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225062 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225062\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"1f587d8031d98b69da197bc38f8ca923","tls_ja3":"771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":155},{"id":11162010,"ip":"198.98.54.65","ts":"2026-07-11 16:55:17.000000","proto":"tcp","src_port":59179,"dst_port":5069,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 12, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.922220352360352, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5069, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b120e6ec3a3ccf152c018c0c2baae2dd8c90f482\u0022, \u0022event_fingerprint\u0022: \u0022dda9d70037a2509cf6a12f35a2ff98e8a81ab3dc\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022payload_hash\u0022: \u00229087bc74edc0c5e53e93f21e775f7538\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5069, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jRuv\ufffd\\u001e+C,\ufffd\ufffd\\\\)\ufffd7\ufffd\ufffd\ufffd:\u0651\ufffd\ufffd\u0605\\u0013f\ufffd\ufffd\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jRuv\ufffd\\u001e+C,\ufffd\ufffd\\\\)\ufffd7\ufffd\ufffd\ufffd:\u0651\ufffd\ufffd\u0605\\u0013f\ufffd\ufffd\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jRuv\ufffd\\u001e+C,\ufffd\ufffd\\\\)\ufffd7\ufffd\ufffd\ufffd:\u0651\ufffd\ufffd\u0605\\u0013f\ufffd\ufffd\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227e10d166d6ed0ff7af2ad3b091f484647f6570a7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jRuv\ufffd\\u001e+C,\ufffd\ufffd\\\\)\ufffd7\ufffd\ufffd\ufffd:\u0651\ufffd\ufffd\u0605\\u0013f\ufffd\ufffd\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5069, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjRuv\ufffd+C,\ufffd\ufffd\\\\)\ufffd7\ufffd\ufffd\ufffd:\u0651\ufffd\ufffd\u0605f\ufffd\ufffd\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225069 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5069, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jRuv\ufffd\\u001e+C,\ufffd\ufffd\\\\)\ufffd7\ufffd\ufffd\ufffd:\u0651\ufffd\ufffd\u0605\\u0013f\ufffd\ufffd\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5069, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjRuv\ufffd+C,\ufffd\ufffd\\\\)\ufffd7\ufffd\ufffd\ufffd:\u0651\ufffd\ufffd\u0605f\ufffd\ufffd\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225069 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225069\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"1f587d8031d98b69da197bc38f8ca923","tls_ja3":"771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":155},{"id":10909409,"ip":"198.98.54.65","ts":"2026-07-10 19:43:55.000000","proto":"tcp","src_port":54834,"dst_port":5070,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 12, \u0022bytes_in\u0022: 155, \u0022payload_entropy\u0022: 4.927090594309793, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5070, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220317e9b44b2c0750a013cbd388a3eb14202c7bb9\u0022, \u0022event_fingerprint\u0022: \u00223e9847e893ec9a3ad0d613da8c24af154ba2f8a5\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022payload_hash\u0022: \u0022fcab85342fa31f0bf534c42c88c14f99\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022tls_ja4\u0022: \u0022t13d0126_f338b42a8f9d_d63375ab50e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 26, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5070, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jQK|\ufffd\ufffd\\u0007P\ufffd\ufffd\\u0015OV\ufffd\ufffd|\\u001d8H\ufffd\\u0005\ufffd\\u0005ti~\ufffd\u0360\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jQK|\ufffd\ufffd\\u0007P\ufffd\ufffd\\u0015OV\ufffd\ufffd|\\u001d8H\ufffd\\u0005\ufffd\\u0005ti~\ufffd\u0360\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jQK|\ufffd\ufffd\\u0007P\ufffd\ufffd\\u0015OV\ufffd\ufffd|\\u001d8H\ufffd\\u0005\ufffd\\u0005ti~\ufffd\u0360\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222000d36668b45ed483cb70e080109a32e7449d68\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jQK|\ufffd\ufffd\\u0007P\ufffd\ufffd\\u0015OV\ufffd\ufffd|\\u001d8H\ufffd\\u0005\ufffd\\u0005ti~\ufffd\u0360\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5070, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjQK|\ufffd\ufffdP\ufffd\ufffdOV\ufffd\ufffd|8H\ufffd\ufffdti~\ufffd\u0360\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5070 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225070 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5070, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003jQK|\ufffd\ufffd\\u0007P\ufffd\ufffd\\u0015OV\ufffd\ufffd|\\u001d8H\ufffd\\u0005\ufffd\\u0005ti~\ufffd\u0360\ufffd\ufffd\\u0000\\u00004\ufffd(\ufffd\u0027\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u00009\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\t\\u0000j\\u0000@\\u00008\\u00002\\u0000\\n\\u0000\\u0013\\u0001\\u0000\\u00005\\u0000\\n\\u0000\\u0006\\u0000\\u0004\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0014\\u0000\\u0012\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00221f587d8031d98b69da197bc38f8ca923\u0022, \u0022tls_ja4\u0022: \u00222e581b50149a6d0d8f3d93e85ed97b6a\u0022, \u0022port\u0022: 5070, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5070 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjQK|\ufffd\ufffdP\ufffd\ufffdOV\ufffd\ufffd|8H\ufffd\ufffdti~\ufffd\u0360\ufffd\ufffd4\ufffd(\ufffd\u0027\ufffd\ufffd\ufffd\ufffd93\ufffd\ufffd=\u003C5\/\ufffd,\ufffd+\ufffd$\ufffd#\ufffd\\n\ufffd\\tj@82\\n5\u0022, \u0022target_port_label\u0022: \u00225070 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225070\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"1f587d8031d98b69da197bc38f8ca923","tls_ja3":"771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-35-23-65281,23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":155},{"id":10269570,"ip":"198.98.54.65","ts":"2026-06-29 07:52:40.000000","proto":"tcp","src_port":56931,"dst_port":5067,"service":null,"classification":"sip_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 449, \u0022payload_entropy\u0022: 5.628917737517759, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 53667, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5067, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223591bcd6ac9994031e5cb501cdb5b02514a471c0\u0022, \u0022event_fingerprint\u0022: \u0022661931db78e44bb880f83c9229f1f6887fdbdac0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab sip_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0384\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0384\u0022], \u0022matched_patterns\u0022: [\u0022pat-0384\u0022], \u0022matched_pattern_names\u0022: [\u0022SIP protocol\u0022], \u0022pattern_ids\u0022: [\u0022pat-0384\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 53667, \u0022org\u0022: \u0022FranTech Solutions\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b98cd38cfe587c0e99ee0b03c80d61f3\u0022, \u0022path_pattern_hash\u0022: \u0022850113ca2503ddab2e70a7e8c1732065\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5067, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022REGISTER sip:62.3.50.33 SIP\/2.0\\r\\nTo: \u003Csip:1000@62.3.50.33\u003E\\r\\nFrom: \u003Csip:1000@62.3.50.33\u003E;tag=b151856fd\\r\\nVia: SIP\/2.0\/TCP 198.98.5\u0022, \u0022request_sample\u0022: \u0022REGISTER sip:62.3.50.33 SIP\/2.0\\r\\nTo: \u003Csip:1000@62.3.50.33\u003E\\r\\nFrom: \u003Csip:1000@62.3.50.33\u003E;tag=b151856fd\\r\\nVia: SIP\/2.0\/TCP 198.98.54.65:56931;branch=z9hG4bK-d87543-004220432-1--d87543;rport\\r\\nCall-ID: 0c13b9fed50b459885a64fa584504e05\\r\\nCSeq: 1 REGISTER\\r\\nContact\u0022, \u0022payload_snippet\u0022: \u0022REGISTER sip:62.3.50.33 SIP\/2.0\\r\\nTo: \u003Csip:1000@62.3.50.33\u003E\\r\\nFrom: \u003Csip:1000@62.3.50.33\u003E;tag=b151856fd\\r\\nVia: SIP\/2.0\/TCP 198.98.5\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022REGISTER sip:62.3.50.33 SIP\/2.0\\r\\nTo: \u003Csip:1000@62.3.50.33\u003E\\r\\nFrom: \u003Csip:1000@62.3.50.33\u003E;tag=b151856fd\\r\\nVia: SIP\/2.0\/TCP 198.98.54.65:56931;branch=z9hG4bK-d87543-004220432-1--d87543;rport\\r\\nCall-ID: 0c13b9fed50b459885a64fa584504e05\\r\\nCSeq: 1 REGISTER\\r\\nContact\u0022, \u0022payload_snippet\u0022: \u0022REGISTER sip:62.3.50.33 SIP\/2.0\\r\\nTo: \u003Csip:1000@62.3.50.33\u003E\\r\\nFrom: \u003Csip:1000@62.3.50.33\u003E;tag=b151856fd\\r\\nVia: SIP\/2.0\/TCP 198.98.5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab sip_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f854cb08f91a7216db77b450dea29b19fbfc81b9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022REGISTER sip:62.3.50.33 SIP\/2.0\\r\\nTo: \u003Csip:1000@62.3.50.33\u003E\\r\\nFrom: \u003Csip:1000@62.3.50.33\u003E;tag=b151856fd\\r\\nVia: SIP\/2.0\/TCP 198.98.5\u0022, \u0022port\u0022: 5067}, \u0022evidence_snippet\u0022: \u0022REGISTER sip:62.3.50.33 SIP\/2.0\\r\\nTo: \u003Csip:1000@62.3.50.33\u003E\\r\\nFrom: \u003Csip:1000@62.3.50.33\u003E;tag=b151856fd\\r\\nVia: SIP\/2.0\/TCP 198.98.5\u0022, \u0022attack_vector\u0022: \u0022sip probe \u00b7 port 5067 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225067\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab sip_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab sip_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 5067, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0384\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0384\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022REGISTER sip:62.3.50.33 SIP\/2.0\\r\\nTo: \u003Csip:1000@62.3.50.33\u003E\\r\\nFrom: \u003Csip:1000@62.3.50.33\u003E;tag=b151856fd\\r\\nVia: SIP\/2.0\/TCP 198.98.5\u0022, \u0022port\u0022: 5067}, \u0022attack_vector\u0022: \u0022sip probe \u00b7 port 5067 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022REGISTER sip:62.3.50.33 SIP\/2.0\\r\\nTo: \u003Csip:1000@62.3.50.33\u003E\\r\\nFrom: \u003Csip:1000@62.3.50.33\u003E;tag=b151856fd\\r\\nVia: SIP\/2.0\/TCP 198.98.5\u0022, \u0022target_port_label\u0022: \u00225067\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225067\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":449}],"total_events":11}