2.57.122.209

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.849998010956864,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c8a44481f21492fe03ce6f4972f58f6f",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017;\ufffd\ufffd\u0018\ufffdp\ufffdg\ufffd\ufffd\u00032B\ufffd'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017;\ufffd\ufffd\u0018\ufffdp\ufffdg\ufffd\ufffd\u00032B\ufffd'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017;\ufffd\ufffd\u0018\ufffdp\ufffdg\ufffd\ufffd\u00032B\ufffd'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017;\ufffd\ufffd\u0018\ufffdp\ufffdg\ufffd\ufffd\u00032B\ufffd'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017;\ufffd\ufffd\u0018\ufffdp\ufffdg\ufffd\ufffd\u00032B\ufffd'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "137cf428aec1ecad9636b457e9c5650566ff3ee9",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017;\ufffd\ufffd\u0018\ufffdp\ufffdg\ufffd\ufffd\u00032B\ufffd'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017;\ufffd\ufffd\u0018\ufffdp\ufffdg\ufffd\ufffd\u00032B\ufffd'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n;\ufffd\ufffd\ufffdp\ufffdg\ufffd\ufffd2B\ufffd'8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017;\ufffd\ufffd\u0018\ufffdp\ufffdg\ufffd\ufffd\u00032B\ufffd'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0017;\ufffd\ufffd\u0018\ufffdp\ufffdg\ufffd\ufffd\u00032B\ufffd'\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n;\ufffd\ufffd\ufffdp\ufffdg\ufffd\ufffd2B\ufffd'8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.8570264931799025,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2aa110500f5d01e56443119c910c93bb",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u0012\u001d\ufffd\u03ad\ufffd\u001fx\ufffd{\ufffd0\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u0012\u001d\ufffd\u03ad\ufffd\u001fx\ufffd{\ufffd0\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u0012\u001d\ufffd\u03ad\ufffd\u001fx\ufffd{\ufffd0\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u0012\u001d\ufffd\u03ad\ufffd\u001fx\ufffd{\ufffd0\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u0012\u001d\ufffd\u03ad\ufffd\u001fx\ufffd{\ufffd0\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0521c29ca7403fab68208491ee3be58906918ff0",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u0012\u001d\ufffd\u03ad\ufffd\u001fx\ufffd{\ufffd0\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u0012\u001d\ufffd\u03ad\ufffd\u001fx\ufffd{\ufffd0\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\u03ad\ufffdx\ufffd{\ufffd0\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u0012\u001d\ufffd\u03ad\ufffd\u001fx\ufffd{\ufffd0\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\u0012\u001d\ufffd\u03ad\ufffd\u001fx\ufffd{\ufffd0\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\u03ad\ufffdx\ufffd{\ufffd0\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.854277754979688,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b13752918a80b98d309aa513d7526156",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u9a93\ufffd\ufffd\u001c\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u9a93\ufffd\ufffd\u001c\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u9a93\ufffd\ufffd\u001c\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u9a93\ufffd\ufffd\u001c\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u9a93\ufffd\ufffd\u001c\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3924d0f04e837c91ea2ac3a0c2d30c5db6bfd577",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u9a93\ufffd\ufffd\u001c\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u9a93\ufffd\ufffd\u001c\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\u9a93\ufffd\ufffd\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u9a93\ufffd\ufffd\u001c\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u9a93\ufffd\ufffd\u001c\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\u9a93\ufffd\ufffd\ufffd9&B\ufffd\ufffd1l\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.852153280726201,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "adb8919409f643fa650db1f3bfdbb1d7",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Z{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\u0000\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Z{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\u0000\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Z{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\u0000\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Z{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\u0000\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Z{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\u0000\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "beba8e1540f3e5069f3a8a1d5681fb4aca3a6ebe",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Z{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\u0000\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Z{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\u0000\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nZ{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Z{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\u0000\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Z{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\u0000\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nZ{o\ufffdC\ufffd$\"\ufffdX\ufffd7N\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.857055797728205,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fb8ba4df5a7b4b3e6e97c244670dd3dd",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\u0010\ufffd_\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\u0010\ufffd_\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\u0010\ufffd_\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\u0010\ufffd_\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\u0010\ufffd_\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ffcf92cecc2c0c6e8b172603dbefcbaaecb902d3",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\u0010\ufffd_\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\u0010\ufffd_\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\ufffd_8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\u0010\ufffd_\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\u0010\ufffd_\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdl\ufffd'qQ6\ufffdzD\ufffdE\ufffd_8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.8552798664385355,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "032ea3340cffb0a54e5b66eea4692339",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1e58a7e8a34ff11dda90059d189afd5fe32bfaa0",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n39>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u001439>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n39>\ufffd\u00f3\ufffd~\ufffd\ufffd\ufffd\u0266\ufffd\ufffd}8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.854571188488229,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "92e42a225d9679cd02bcec9c38a81bbc",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}@~\ufffd\ufffd\/D\u0012J|\ufffd<\ufffd\ufffd\ufffdZ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}@~\ufffd\ufffd\/D\u0012J|\ufffd<\ufffd\ufffd\ufffdZ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}@~\ufffd\ufffd\/D\u0012J|\ufffd<\ufffd\ufffd\ufffdZ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}@~\ufffd\ufffd\/D\u0012J|\ufffd<\ufffd\ufffd\ufffdZ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}@~\ufffd\ufffd\/D\u0012J|\ufffd<\ufffd\ufffd\ufffdZ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d7adf5ed21f8e3a8e6eb694832a936977ca8ac48",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}@~\ufffd\ufffd\/D\u0012J|\ufffd<\ufffd\ufffd\ufffdZ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}@~\ufffd\ufffd\/D\u0012J|\ufffd<\ufffd\ufffd\ufffdZ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n}@~\ufffd\ufffd\/DJ|\ufffd<\ufffd\ufffd\ufffdZ8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}@~\ufffd\ufffd\/D\u0012J|\ufffd<\ufffd\ufffd\ufffdZ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}@~\ufffd\ufffd\/D\u0012J|\ufffd<\ufffd\ufffd\ufffdZ\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n}@~\ufffd\ufffd\/DJ|\ufffd<\ufffd\ufffd\ufffdZ8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.860854585705668,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "259df5aadc98a82420e52163a7f8b45b",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd5\u000f)\ufffd\ufffd\ufffd\u000e\ufffd!\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd5\u000f)\ufffd\ufffd\ufffd\u000e\ufffd!\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd5\u000f)\ufffd\ufffd\ufffd\u000e\ufffd!\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd5\u000f)\ufffd\ufffd\ufffd\u000e\ufffd!\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd5\u000f)\ufffd\ufffd\ufffd\u000e\ufffd!\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2811e23ba5df1d005ba49fa49b889dd9e8bdd232",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd5\u000f)\ufffd\ufffd\ufffd\u000e\ufffd!\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd5\u000f)\ufffd\ufffd\ufffd\u000e\ufffd!\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd5)\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd5\u000f)\ufffd\ufffd\ufffd\u000e\ufffd!\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd5\u000f)\ufffd\ufffd\ufffd\u000e\ufffd!\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd5)\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.837085416232237,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "de1534e4e28f3ad01f529b9b8c0588f3",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0000o.Y\ufffdf\u001dkN\ufffdwU\ufffd\ufffd\u001b{\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0000o.Y\ufffdf\u001dkN\ufffdwU\ufffd\ufffd\u001b{\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0000o.Y\ufffdf\u001dkN\ufffdwU\ufffd\ufffd\u001b{\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0000o.Y\ufffdf\u001dkN\ufffdwU\ufffd\ufffd\u001b{\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0000o.Y\ufffdf\u001dkN\ufffdwU\ufffd\ufffd\u001b{\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1e735f4c0e2c8456a02e3bc5550f3a8ea15e00f9",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0000o.Y\ufffdf\u001dkN\ufffdwU\ufffd\ufffd\u001b{\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0000o.Y\ufffdf\u001dkN\ufffdwU\ufffd\ufffd\u001b{\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\no.Y\ufffdfkN\ufffdwU\ufffd\ufffd{8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0000o.Y\ufffdf\u001dkN\ufffdwU\ufffd\ufffd\u001b{\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0000o.Y\ufffdf\u001dkN\ufffdwU\ufffd\ufffd\u001b{\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\no.Y\ufffdfkN\ufffdwU\ufffd\ufffd{8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.855123259661534,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0e4c8f42336d590491b8229685e752ea",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0003\ufffdO\ufffdY\u0014\ufffd\ufffd^p\ufffd\ufffd\ufffd\b\ufffd,\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0003\ufffdO\ufffdY\u0014\ufffd\ufffd^p\ufffd\ufffd\ufffd\b\ufffd,\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0003\ufffdO\ufffdY\u0014\ufffd\ufffd^p\ufffd\ufffd\ufffd\b\ufffd,\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0003\ufffdO\ufffdY\u0014\ufffd\ufffd^p\ufffd\ufffd\ufffd\b\ufffd,\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0003\ufffdO\ufffdY\u0014\ufffd\ufffd^p\ufffd\ufffd\ufffd\b\ufffd,\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6561de1296c4a4c469b986ef532c381a5591c03d",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0003\ufffdO\ufffdY\u0014\ufffd\ufffd^p\ufffd\ufffd\ufffd\b\ufffd,\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0003\ufffdO\ufffdY\u0014\ufffd\ufffd^p\ufffd\ufffd\ufffd\b\ufffd,\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdO\ufffdY\ufffd\ufffd^p\ufffd\ufffd\ufffd\ufffd,8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0003\ufffdO\ufffdY\u0014\ufffd\ufffd^p\ufffd\ufffd\ufffd\b\ufffd,\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0003\ufffdO\ufffdY\u0014\ufffd\ufffd^p\ufffd\ufffd\ufffd\b\ufffd,\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdO\ufffdY\ufffd\ufffd^p\ufffd\ufffd\ufffd\ufffd,8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.837882832100288,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "dd2f6521ac66e1eac6761c08595bf141",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0000\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0000\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0000\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0000\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0000\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "48e3b8351fd099f634c53f2b4e8d2991467de61d",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0000\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0000\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0000\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0000\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdfVw\ufffd%6\ufffd`)@F\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.863693507574322,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d836b36847f23856bf488df55261fc53",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\u0006\ufffdU7 \ufffd\ufffd\ufffd3\u001b\ufffd\ufffd\ufffdN\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\u0006\ufffdU7 \ufffd\ufffd\ufffd3\u001b\ufffd\ufffd\ufffdN\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\u0006\ufffdU7 \ufffd\ufffd\ufffd3\u001b\ufffd\ufffd\ufffdN\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\u0006\ufffdU7 \ufffd\ufffd\ufffd3\u001b\ufffd\ufffd\ufffdN\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\u0006\ufffdU7 \ufffd\ufffd\ufffd3\u001b\ufffd\ufffd\ufffdN\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "94fa1ac9040dbffc7bcd7f7229af76fe0c153da6",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\u0006\ufffdU7 \ufffd\ufffd\ufffd3\u001b\ufffd\ufffd\ufffdN\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\u0006\ufffdU7 \ufffd\ufffd\ufffd3\u001b\ufffd\ufffd\ufffdN\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nY\ufffdU7 \ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdN\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\u0006\ufffdU7 \ufffd\ufffd\ufffd3\u001b\ufffd\ufffd\ufffdN\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\u0006\ufffdU7 \ufffd\ufffd\ufffd3\u001b\ufffd\ufffd\ufffdN\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nY\ufffdU7 \ufffd\ufffd\ufffd3\ufffd\ufffd\ufffdN\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.843626058109581,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d407d373562ce9db710cbfa8a27669dd",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A.oSW\r\ufffd\ufffd6\u0014\ufffd{\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A.oSW\r\ufffd\ufffd6\u0014\ufffd{\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A.oSW\r\ufffd\ufffd6\u0014\ufffd{\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A.oSW\r\ufffd\ufffd6\u0014\ufffd{\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A.oSW\r\ufffd\ufffd6\u0014\ufffd{\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3a0a8e00a39d0b36c1d352723f2e7dc6aab4de6c",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A.oSW\r\ufffd\ufffd6\u0014\ufffd{\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A.oSW\r\ufffd\ufffd6\u0014\ufffd{\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nA.oSW\r\ufffd\ufffd6\ufffd{\ufffd\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A.oSW\r\ufffd\ufffd6\u0014\ufffd{\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014A.oSW\r\ufffd\ufffd6\u0014\ufffd{\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nA.oSW\r\ufffd\ufffd6\ufffd{\ufffd\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.851392043863456,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8fcac5305eb5aa9166b559e159c9afde",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d517d4818c5660655851d161a6bb073df1ff9a13",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\ufffdc\ufffd`9Z\ufffd\ufffdI\ufffdS\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.8612094980191065,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0a790d2f455a1e175375caf4e4550dca",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "41dc2b82d56089c6e142711d33098326ae249151",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdH\ufffd}\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.844281078908988,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "cf26b2d74d2cfc1c01372d3926c2f85e",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffd\ufffd\u000eb2%\u07a0\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffd\ufffd\u000eb2%\u07a0\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffd\ufffd\u000eb2%\u07a0\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffd\ufffd\u000eb2%\u07a0\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffd\ufffd\u000eb2%\u07a0\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c19589afa240c35337b67aae8278e09e0b040299",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffd\ufffd\u000eb2%\u07a0\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffd\ufffd\u000eb2%\u07a0\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffdb2%\u07a08curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffd\ufffd\u000eb2%\u07a0\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\ufffd\u0014\ufffdm\ufffd\ufffd\ufffd\u000eb2%\u07a0\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffdb2%\u07a08curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.855608733821387,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d3b1e32fa847f6f4374aee8b8c7911e7",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aed8f22fbf184023c353f9a8e82b24e2314f2a74",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\u05b5\ufffdJF\ufffda\ufffd8%\ufffd\ufffd`^8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.83376581593775,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "765881031162a56cb873a40f8f454c0f",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "025d01bd862f1321f07b4c7cd512ef0f14a6db4d",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx\u0004\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd-T\ufffd\n\ufffdVhcd\ufffd:\ufffdx8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.840023795353869,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2aa29f9af91e95ce038c8e982a15d097",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\u0006\u0641\ufffd\u0005\u0018-8\ufffd\ufffd\u013e\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\u0006\u0641\ufffd\u0005\u0018-8\ufffd\ufffd\u013e\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\u0006\u0641\ufffd\u0005\u0018-8\ufffd\ufffd\u013e\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\u0006\u0641\ufffd\u0005\u0018-8\ufffd\ufffd\u013e\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\u0006\u0641\ufffd\u0005\u0018-8\ufffd\ufffd\u013e\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "52553c820f9d6fc513990a69f8ace5c5ad468048",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\u0006\u0641\ufffd\u0005\u0018-8\ufffd\ufffd\u013e\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\u0006\u0641\ufffd\u0005\u0018-8\ufffd\ufffd\u013e\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdm\u0641\ufffd-8\ufffd\ufffd\u013e\ufffdY8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\u0006\u0641\ufffd\u0005\u0018-8\ufffd\ufffd\u013e\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdm\u0006\u0641\ufffd\u0005\u0018-8\ufffd\ufffd\u013e\ufffdY\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdm\u0641\ufffd-8\ufffd\ufffd\u013e\ufffdY8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.845420488931902,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6abbe3a55c6d33b982c3a395e000f14f",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e3761734aff6bd8cb198d56dae16d30ebbe2fecf",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd:\ufffd\ufffd\n\ufffd\ufffd\ufffdXr\ufffd\ufffd\ufffdI%H8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.851574506195665,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "45a73cbdc209fd62345c99d486e0e7aa",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\/\u0288;\u0017\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\/\u0288;\u0017\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\/\u0288;\u0017\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\/\u0288;\u0017\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\/\u0288;\u0017\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9d7fdd79c550b0b044aef03b11a9e2c2f7db6e97",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\/\u0288;\u0017\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\/\u0288;\u0017\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\/\u0288;\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\/\u0288;\u0017\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\/\u0288;\u0017\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\/\u0288;\ufffd5\ufffd#\ufffdc\"@\ufffdW\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.852494709486999,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0ce2e1cc031ec264f3a65a333f824018",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u001c\u000bX\ufffd}\ufffd\ufffda\ufffd}\u001f\ufffdd[\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u001c\u000bX\ufffd}\ufffd\ufffda\ufffd}\u001f\ufffdd[\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u001c\u000bX\ufffd}\ufffd\ufffda\ufffd}\u001f\ufffdd[\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u001c\u000bX\ufffd}\ufffd\ufffda\ufffd}\u001f\ufffdd[\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u001c\u000bX\ufffd}\ufffd\ufffda\ufffd}\u001f\ufffdd[\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "78e4b1d76f2e171f60be233aa903249cd5cb9e6d",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u001c\u000bX\ufffd}\ufffd\ufffda\ufffd}\u001f\ufffdd[\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u001c\u000bX\ufffd}\ufffd\ufffda\ufffd}\u001f\ufffdd[\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdX\ufffd}\ufffd\ufffda\ufffd}\ufffdd[\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u001c\u000bX\ufffd}\ufffd\ufffda\ufffd}\u001f\ufffdd[\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u001c\u000bX\ufffd}\ufffd\ufffda\ufffd}\u001f\ufffdd[\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdX\ufffd}\ufffd\ufffda\ufffd}\ufffdd[\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.840634684147076,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b2a910cdf9a86128335e56aec2baf65a",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7739d2c882a12b11dc3f2ec4691e625d9303eb42",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n!\ufffd\ufffdc\ufffd@\ufffd\\le\ufffd\ufffd\ufffdI\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.841662117283848,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1341f4021edf1fc0588d25a5ed447776",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014|o)\u0010Hiy\b\ufffds\ufffd\ufffd\bz)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014|o)\u0010Hiy\b\ufffds\ufffd\ufffd\bz)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014|o)\u0010Hiy\b\ufffds\ufffd\ufffd\bz)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014|o)\u0010Hiy\b\ufffds\ufffd\ufffd\bz)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014|o)\u0010Hiy\b\ufffds\ufffd\ufffd\bz)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a0117d44f729eeaee5aae219e77a865771587514",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014|o)\u0010Hiy\b\ufffds\ufffd\ufffd\bz)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014|o)\u0010Hiy\b\ufffds\ufffd\ufffd\bz)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n|o)Hiy\ufffds\ufffd\ufffdz)\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014|o)\u0010Hiy\b\ufffds\ufffd\ufffd\bz)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014|o)\u0010Hiy\b\ufffds\ufffd\ufffd\bz)\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n|o)Hiy\ufffds\ufffd\ufffdz)\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2fd70191c11cf3311d4327222cbdc90f08e4fc6b",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42
    },
    "named_classification_skipped": true,
    "named_candidate": "ssh_probe",
    "service_name": "ssh",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "253e0824820a41dd714cfbe0c15753d50a2181da",
    "protocol_details": {
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner_grab",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2fd70191c11cf3311d4327222cbdc90f08e4fc6b",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42
    },
    "named_classification_skipped": true,
    "named_candidate": "ssh_probe",
    "service_name": "ssh",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "253e0824820a41dd714cfbe0c15753d50a2181da",
    "protocol_details": {
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner_grab",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "52aff1c3ab5260ce88a91e156d1e2db6de2ba6df",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 48
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6eb305af68f2de18b58fc9ff6f14784d59b1760",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go",
        "payload_preview": "SSH-2.0-Go",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go",
            "payload_preview": "SSH-2.0-Go",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "52aff1c3ab5260ce88a91e156d1e2db6de2ba6df",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 48
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6eb305af68f2de18b58fc9ff6f14784d59b1760",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go",
        "payload_preview": "SSH-2.0-Go",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go",
            "payload_preview": "SSH-2.0-Go",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "52aff1c3ab5260ce88a91e156d1e2db6de2ba6df",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 48
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6eb305af68f2de18b58fc9ff6f14784d59b1760",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go",
        "payload_preview": "SSH-2.0-Go",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go",
            "payload_preview": "SSH-2.0-Go",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.860025931005954,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0103",
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass",
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0103",
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b7a62d43807bc5f2219ae3f74934972d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\r\/\/[\ufffd\u0006:H'\ufffdI\ufffd\u001aN\n\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\r\/\/[\ufffd\u0006:H'\ufffdI\ufffd\u001aN\n\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\r\/\/[\ufffd\u0006:H'\ufffdI\ufffd\u001aN\n\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\r\/\/[\ufffd\u0006:H'\ufffdI\ufffd\u001aN\n\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\r\/\/[\ufffd\u0006:H'\ufffdI\ufffd\u001aN\n\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "013fa92991d8807c0c835cfb49403546b10894bf",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\r\/\/[\ufffd\u0006:H'\ufffdI\ufffd\u001aN\n\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\r\/\/[\ufffd\u0006:H'\ufffdI\ufffd\u001aN\n\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\r\/\/[\ufffd:H'\ufffdI\ufffdN\n\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\r\/\/[\ufffd\u0006:H'\ufffdI\ufffd\u001aN\n\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\r\/\/[\ufffd\u0006:H'\ufffdI\ufffd\u001aN\n\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\r\/\/[\ufffd:H'\ufffdI\ufffdN\n\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.859913410912684,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "672031226c5dddba90f0f8ada088c5a9",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014P\ufffd\ufffd\ufffd!\u0005\ufffd\u0019_\ufffd+<\u0004\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014P\ufffd\ufffd\ufffd!\u0005\ufffd\u0019_\ufffd+<\u0004\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014P\ufffd\ufffd\ufffd!\u0005\ufffd\u0019_\ufffd+<\u0004\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014P\ufffd\ufffd\ufffd!\u0005\ufffd\u0019_\ufffd+<\u0004\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014P\ufffd\ufffd\ufffd!\u0005\ufffd\u0019_\ufffd+<\u0004\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fef782eb45d3eb059d98ff00cf3dbe70c0550804",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014P\ufffd\ufffd\ufffd!\u0005\ufffd\u0019_\ufffd+<\u0004\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014P\ufffd\ufffd\ufffd!\u0005\ufffd\u0019_\ufffd+<\u0004\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nP\ufffd\ufffd\ufffd!\ufffd_\ufffd+<\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014P\ufffd\ufffd\ufffd!\u0005\ufffd\u0019_\ufffd+<\u0004\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014P\ufffd\ufffd\ufffd!\u0005\ufffd\u0019_\ufffd+<\u0004\ufffd\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nP\ufffd\ufffd\ufffd!\ufffd_\ufffd+<\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "52aff1c3ab5260ce88a91e156d1e2db6de2ba6df",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 48
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6eb305af68f2de18b58fc9ff6f14784d59b1760",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go",
        "payload_preview": "SSH-2.0-Go",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go",
            "payload_preview": "SSH-2.0-Go",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.833869200493363,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b0fe96969a7da5ab5ecfbfae10077346",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014c\ufffd2\u0004.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014c\ufffd2\u0004.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014c\ufffd2\u0004.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014c\ufffd2\u0004.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014c\ufffd2\u0004.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b8e0f5a82fd3c1389a312aee6a108c8b4205c622",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014c\ufffd2\u0004.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014c\ufffd2\u0004.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nc\ufffd2.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014c\ufffd2\u0004.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014c\ufffd2\u0004.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nc\ufffd2.\ufffd\ufffdpB\u0742\ufffd~-]\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.840620101312345,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "51b64f753388fdfaa7301c9ed3a40327",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6$\u000b^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6$\u000b^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6$\u000b^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6$\u000b^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6$\u000b^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7430a3ee2397419c63d2e60fb0c5925f6f362407",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6$\u000b^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6$\u000b^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd6$^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6$\u000b^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6$\u000b^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd6$^\ufffdo\\\t\ufffdJs\ufffd\ufffd2\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "52aff1c3ab5260ce88a91e156d1e2db6de2ba6df",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 48
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6eb305af68f2de18b58fc9ff6f14784d59b1760",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go",
        "payload_preview": "SSH-2.0-Go",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go",
            "payload_preview": "SSH-2.0-Go",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.8348402506005685,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ec00e64cfc3ffacadc958636c775f81a",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c2\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c2\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c2\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c2\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c2\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "599e771892dcbacbc213e13de628a0c3416f3a94",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c2\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c2\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c28curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c2\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c2\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdE]\ufffd\n20\ufffdjg~c\ufffdz\u00c28curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "52aff1c3ab5260ce88a91e156d1e2db6de2ba6df",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 48
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6eb305af68f2de18b58fc9ff6f14784d59b1760",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go",
        "payload_preview": "SSH-2.0-Go",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go",
            "payload_preview": "SSH-2.0-Go",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2fd70191c11cf3311d4327222cbdc90f08e4fc6b",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42
    },
    "named_classification_skipped": true,
    "named_candidate": "ssh_probe",
    "service_name": "ssh",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "253e0824820a41dd714cfbe0c15753d50a2181da",
    "protocol_details": {
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner_grab",
        "ssh_emulated"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "52aff1c3ab5260ce88a91e156d1e2db6de2ba6df",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 48
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6eb305af68f2de18b58fc9ff6f14784d59b1760",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go",
        "payload_preview": "SSH-2.0-Go",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go",
            "payload_preview": "SSH-2.0-Go",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2fd70191c11cf3311d4327222cbdc90f08e4fc6b",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42
    },
    "named_classification_skipped": true,
    "named_candidate": "ssh_probe",
    "service_name": "ssh",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "253e0824820a41dd714cfbe0c15753d50a2181da",
    "protocol_details": {
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner_grab",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2fd70191c11cf3311d4327222cbdc90f08e4fc6b",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42
    },
    "named_classification_skipped": true,
    "named_candidate": "ssh_probe",
    "service_name": "ssh",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "253e0824820a41dd714cfbe0c15753d50a2181da",
    "protocol_details": {
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner_grab",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.837150615371318,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9dade31fb6dd24e128a26d2d8fa0eb6b",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffd\u001fs\/N\u0002\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffd\u001fs\/N\u0002\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffd\u001fs\/N\u0002\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffd\u001fs\/N\u0002\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffd\u001fs\/N\u0002\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ed12831e472e1a4e29adaf392940369fd039d149",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffd\u001fs\/N\u0002\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffd\u001fs\/N\u0002\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffds\/N8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffd\u001fs\/N\u0002\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffd\u001fs\/N\u0002\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\u032e\ufffd\tLn\ufffd\ufffd\ufffd\ufffds\/N8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}