2.57.17.220

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e312034303320466f7262696464656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2038370d0a0d0a7b226b696e64223a22537461747573222c2261706956657273696f6e223a227631222c22737461747573223a224661696c75",
    "emulator_response_len": 165,
    "bytes_in": 190,
    "payload_entropy": 5.134092014580243,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "k8s-api",
    "app_proto": "k8s-api",
    "asn": 25369,
    "country": "GB",
    "dst_port": 6443,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 6.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 35,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "ef86356910d7f7cdd52447d2d53697ca6a0c79fa",
    "event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
    "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "k8s-api",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "600631964c5b85d2fb8a6380c5fff721",
        "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b"
    },
    "target_context": {
        "dst_port": 6443,
        "service": "k8s-api",
        "service_name": "k8s-api",
        "risk_score": 35
    },
    "payload_preview": "GET \/apis HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "request_sample": "GET \/apis HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: application\/json\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/apis HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "request_sample": "GET \/apis HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: application\/json\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/apis HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "cloud_infra_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c7c28b253a3f1bcd2a4b3953eb18982ad2e4e24c",
    "protocol_details": {
        "payload_preview": "GET \/apis HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "port": 6443,
        "service": "k8s-api",
        "service_label_fr": "K8S API"
    },
    "evidence_snippet": "GET \/apis HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
    "target_port_label": "6443 \u00b7 K8S API",
    "emulator_service": "k8s-api",
    "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "k8s-api",
        "service_label_fr": "K8S API",
        "dst_port": 6443,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-k8s-api",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/apis HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
            "port": 6443,
            "service": "k8s-api",
            "service_label_fr": "K8S API"
        },
        "attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/apis HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "6443 \u00b7 K8S API",
        "emulator_service": "k8s-api",
        "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "k8s_api",
        "service_banner": "honeypot-k8s-api",
        "service_os": "linux",
        "dst_port": "6443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "k8s_api_emulated",
        "k8s_api_payload",
        "kubernetes_probe",
        "mozi_pattern",
        "net_kubernetes_probe"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "7b7ceeb8769b41299faf7c8b50702f8be7063897",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 445,
    "payload_entropy": 5.191356311817131,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 20001,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "8593f32790c0a4b1ab5da2d7ac423e9b2a4471ba",
    "event_fingerprint": "a1a4121fd17f482216f952e6c89e7e34c4871a73",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "5efd19769487b3d95924b483af8c8728",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 20001,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:20001\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:20001\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:20001\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:20001\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:20001\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "96584fda76a66454c0d9daae41b33e1dddb8fa49",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 20001,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:20001\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:20001 \u00b7 (tentative d'exploit)",
    "target_port_label": "20001 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 20001,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 20001,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:20001 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:20001\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "target_port_label": "20001 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "20001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "2ac4cd6a67a08fb197a78636bf2b1a5db474c0f7",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 173,
    "payload_entropy": 5.193328718516693,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 9599,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 58,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "eb2e965dbd583333d743ea785204c8ddd1b5f1d0",
    "event_fingerprint": "f2c2c6cb073a015f4062cf00a5968d0f6d8b29b8",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 58
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "dd38f176ec4b0ff24218dd7a1cf360b4",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 9599,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9599\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9599\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9599\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9599\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9599\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "043b12367d64af0c3a147d86b2898b75b80eba89",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 9599,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9599\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:9599 \u00b7 (tentative d'exploit)",
    "target_port_label": "9599 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 58
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9599,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 9599,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:9599 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9599\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "target_port_label": "9599 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9599"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": null,
    "app_proto": null,
    "asn": 25369,
    "country": "GB",
    "dst_port": 7702,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e30891c3e6bac72e6b609a49b26affbb53b4c9cd",
    "event_fingerprint": "fa7c281c491599363f89e28570fd7d152c93a149",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 7702,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d86bac8f9c9c881b963a6626fd094efec869d5c0",
    "protocol_details": {
        "port": 7702
    },
    "attack_vector": "Sonde port \u00b7 port 7702 \u00b7 (sonde \/ probe)",
    "target_port_label": "7702",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7702,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 7702
        },
        "attack_vector": "Sonde port \u00b7 port 7702 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7702",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7702"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "8b97437ff374405a278fdc88a2e6c55ca156a6eb",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.174999165850639,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 11287,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d8d0cb3a267bbf333454ff5442925897a482690e",
    "event_fingerprint": "aa821491d9974168b7f5b32266508e5962717729",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "0f18031da19c965aefa41d5b42a1c9d9",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 11287,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11287\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11287\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11287\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11287\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11287\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "93500acb2587452d87e4e29385f154abe968484f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 11287,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11287\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:11287 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "11287 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11287,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 11287,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:11287 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:11287\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "11287 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11287"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "c56e7e6a63e4d618f3388c0dcb44050b91b7c8e2",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.203830856275914,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 11701,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "7e893efa0090fcab82cd7be15317f837dc2ce012",
    "event_fingerprint": "6429f2378e36e99ac30ed019ba5110a96404815f",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 61
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "6fadb3bff8cf2037a074fcfdb470e291",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 11701,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11701\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11701\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11701\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11701\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11701\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "52e944f048243b0e39ea5ac360bf0e277ae5f80b",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 11701,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11701\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:11701 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "11701 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 61
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11701,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 11701,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:11701 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11701\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "11701 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11701"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "236d4f6cbbf86e658aa8afac4343fb2e7785b9c5",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 185,
    "payload_entropy": 5.189879772958003,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 14245,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 57,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "c14b681a5542f00cd4fe613c952bdce76e5572e8",
    "event_fingerprint": "595e17faa4b85d5aad98611f40d9ebbc60369b6a",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.5,
    "classification_confidence": 0.5,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 57
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "5e39e2078c75144266a91056b79334cc",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 14245,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:14245\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:14245\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:14245\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:14245\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:14245\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "88a3998e85d6798bf9dd6fe079cd5c8b04516db7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 14245,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:14245\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:14245 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "14245 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 57
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 14245,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 14245,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:14245 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:14245\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "target_port_label": "14245 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "14245"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "99aace108f38b0ef45a99b319194ade93126ca43",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 444,
    "payload_entropy": 5.202605108993502,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 4023,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 63,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "7db5a204bf8792d6bf337383ed7399e86739c470",
    "event_fingerprint": "133f517fedd1bb09681b3b809c22cc40b3b5b5fd",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 63
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "54a18f080fee76464266e91bd3d3ddfb",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 4023,
        "service": "http",
        "service_name": "http",
        "risk_score": 63
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4023\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Len",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4023\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version: ",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4023\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Len",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4023\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version: ",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4023\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Len",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "73e1c5bd1ed940c226c4ee0b1aeede24a3cf3cac",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 4023,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4023\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Len",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:4023 \u00b7 (tentative d'exploit)",
    "target_port_label": "4023 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 63
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 63,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4023,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 4023,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:4023 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:4023\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Len",
        "target_port_label": "4023 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4023"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "a46018a99d9107d0f1360e5ffc8b38f135fa3827",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 190,
    "payload_entropy": 5.169806595146304,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 4753,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 56,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "6d272f59a75f80adc4fa05959ba7e0439aa8f5b8",
    "event_fingerprint": "0d50415b15f8e38480beb092380a6ff6820a5307",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 56,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "0419383d7ef6026186b2390b6198598c",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 4753,
        "service": "http",
        "service_name": "http",
        "risk_score": 56
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:4753\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: t",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:4753\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:4753\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: t",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:4753\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:4753\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: t",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a2c4236d3faedaec4c65779ffd9b92e947e8bb88",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 4753,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:4753\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: t",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:4753 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "4753 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 56,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4753,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 4753,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:4753 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:4753\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: t",
        "target_port_label": "4753 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4753"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "3cc3e508a16309c0f9d07456522ed98e9dc38c47",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 445,
    "payload_entropy": 5.213379388355963,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 21048,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 64,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "7f0d3fde3fbe9c3d2475ade8a4dda86a2ea868ad",
    "event_fingerprint": "49d59c03efbe11d92f12e7af21be3ee86e8634a9",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 64,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "13090b9ea996b42a8f6d0a2af24ed816",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 21048,
        "service": "http",
        "service_name": "http",
        "risk_score": 64
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21048\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21048\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21048\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21048\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21048\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "314681368b8c8d9e0006dd4544121e9ba39f225f",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 21048,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21048\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:21048 \u00b7 (tentative d'exploit)",
    "target_port_label": "21048 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 64,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 64,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 21048,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 21048,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:21048 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21048\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "target_port_label": "21048 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "21048"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "147171403eaa87b4714b5e1a2c931874d7490f59",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.208705227948272,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 14662,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 64,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "0278bec41b89acc7044454f4f646a725bf8ce254",
    "event_fingerprint": "0172ddfbf82bffd92f450e261fa3aa45fc6c2977",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 64
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "21f0b04b76b76a17ee3e74ed230695fa",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 14662,
        "service": "http",
        "service_name": "http",
        "risk_score": 64
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:14662\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:14662\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:14662\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:14662\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:14662\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7256ca54af00849b5a56f653986edf5cad61ae08",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 14662,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:14662\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:14662 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "14662 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 64
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 64,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 14662,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 14662,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:14662 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:14662\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "14662 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "14662"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "dbd7935e0cd545a9e2e862d30577a6d9f6c2546d",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 184,
    "payload_entropy": 5.168791968728772,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 1180,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b54fb058e7adf79c615885f11010fb5a4f277509",
    "event_fingerprint": "9ae07c71e886a43155d88e622ef9505961610caf",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.6,
    "classification_confidence": 0.6,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "f81d89b09cf88b9f892da027a6021204",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 1180,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1180\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1180\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1180\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1180\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1180\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "79b54d47caf6ffe791c038bc53f222027a6d3bc5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 1180,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1180\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:1180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "1180 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1180,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 1180,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:1180 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:1180\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "target_port_label": "1180 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1180"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "1163ded743ae63d99d515d7f6b346c3259d9144e",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.1540567574736755,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 10517,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2b04bd50d22a26d74b35dcd06d7bf2fee7ba4829",
    "event_fingerprint": "af97ae1ac29b91965817025f1781d0fd55c3cb66",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "35f144e5fcb9b347500ed512a3ab4a8c",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 10517,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:10517\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:10517\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:10517\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:10517\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:10517\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0b38ccc56ca025c1076b1d23ca007265640dbb30",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 10517,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:10517\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:10517 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "10517 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 10517,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 10517,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:10517 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:10517\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "10517 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "10517"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "5a1a903e64f0b2a8f6ee358debf4a26f343bda69",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 445,
    "payload_entropy": 5.211822630140098,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 22942,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "eee867e28e099fbeaf08728d347de818125868fa",
    "event_fingerprint": "7dba7a27dc62670019f1186a911c3f63a086c153",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "56b7b48430ba60435279043288b92881",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 22942,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:22942\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:22942\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:22942\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:22942\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:22942\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a089aa5d64bcc26c2d2eb7155b38374426133df0",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 22942,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:22942\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:22942 \u00b7 (tentative d'exploit)",
    "target_port_label": "22942 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 22942,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 22942,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:22942 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:22942\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "target_port_label": "22942 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "22942"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "3e8946f4d585eef10eb23c968a1e6b0e900fcdc0",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 174,
    "payload_entropy": 5.201734429372012,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 31409,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 56,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "7db81fb7f086b0cf1f2427983e037d52850c312a",
    "event_fingerprint": "5fdd5c7d0b6d3d7fde782b2277b1269b10f38de3",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 56
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "ea36873bfc807d2b03fa309c525acac1",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 31409,
        "service": "http",
        "service_name": "http",
        "risk_score": 56
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31409\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31409\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31409\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31409\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31409\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b58f3dbcc909a5f847c7ced2d9dc81c8ca28f2be",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 31409,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31409\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:31409 \u00b7 (tentative d'exploit)",
    "target_port_label": "31409 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 56
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 31409,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 31409,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:31409 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31409\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "target_port_label": "31409 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "31409"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "dcada3f41a593e89e685ef259fcbbe9a17aa8a6e",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 174,
    "payload_entropy": 5.176650935253619,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 31623,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 55,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "c1a035e86aabad8fbe7e728d439105964c68e424",
    "event_fingerprint": "aa74dedf0262401a59f7c93ca19637b1909e7443",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 55
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "a346f2834e5423d369ab8072f85170ae",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 31623,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31623\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31623\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31623\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31623\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31623\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "42adc2fa3991d059c6e32526de12d5396f219bd6",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 31623,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31623\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:31623 \u00b7 (tentative d'exploit)",
    "target_port_label": "31623 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 55
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 31623,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 31623,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:31623 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31623\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "target_port_label": "31623 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "31623"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "d567f5a5151140a97675e26c8bbae5094beb7c3c",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 445,
    "payload_entropy": 5.2006213748652526,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 15665,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "bb37b358925f35fb4c76d3f67e2228c2b3bb87df",
    "event_fingerprint": "92345bf9ffda07f75b6e426253cb391fc4330763",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "bc36b29681a01d40dd285c64077e712f",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 15665,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:15665\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:15665\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:15665\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:15665\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:15665\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4134bf3224d8550301529cac595de0a240f3f9b5",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 15665,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:15665\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:15665 \u00b7 (tentative d'exploit)",
    "target_port_label": "15665 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 15665,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 15665,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:15665 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:15665\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "target_port_label": "15665 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "15665"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "c4a305f3f6a81cac3c19450a1232cff88113c1d9",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.1834266028895755,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 23779,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "3c1e847d23dff2462feeaf009fc6efcdd8b0dac6",
    "event_fingerprint": "a34dc849b50e4424443e90f5f029d295dab44907",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "478629d4558c659d2152dda536cfa7b8",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 23779,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:23779\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:23779\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:23779\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:23779\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:23779\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fc47456caa2e158dd00616d5ed4ac4f1d99e3e12",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 23779,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:23779\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:23779 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "23779 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 23779,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 23779,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:23779 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:23779\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "23779 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "23779"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "7fd7fd0bfec3dc0de8045faf7352d1bd3973ee37",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.205593850485742,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 13218,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "69c4ee84b6a51485ba5a7f5f62a5b6747d3d4073",
    "event_fingerprint": "5d4ba5c4d8c91e83825e99249509e6cfe5deac4e",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "44d3875d9c534277efbbc1b41c0d4cf9",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 13218,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:13218\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:13218\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:13218\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:13218\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:13218\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b7e6a303d3e23aae506b0affd9f89490c4a36bb5",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 13218,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:13218\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:13218 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "13218 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (2.57.17.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 13218,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 13218,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:13218 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:13218\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "13218 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (2.57.17.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "13218"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "2.57.17.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "c26762cfd17d56e8b520c77c86cc3a2d31f61511",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.172955398701093,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 15459,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 57,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "3d920f58278827b2df1022c66b7f81276de989cb",
    "event_fingerprint": "0b150d7c4d501f53be593cd7d5ca9872792c51a7",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 57
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "f201f23727b8c3f06dfa3ea6c13f7ac3",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 15459,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:15459\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:15459\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:15459\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:15459\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:15459\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "940a9f9e393223e0a83f0fc3346d1141a2b564a4",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 15459,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:15459\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:15459 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "15459 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 57
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 15459,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 15459,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:15459 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:15459\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "15459 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "15459"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "4320a9b7ed0dbe1f4f85aa25d5aefb0ad4a477ed",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 445,
    "payload_entropy": 5.220838144353679,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 19975,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c9d815f0db8283d90202de48dbca7630b041083d",
    "event_fingerprint": "3d916dae9f504c467167c7fb5a906ddf95537bfe",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 61
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "d7f10b63f9726dea14c706b6ecf43bac",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 19975,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:19975\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:19975\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:19975\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:19975\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:19975\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "702e753a88bcb1483f9f0ac01c5b453869a75070",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 19975,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:19975\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:19975 \u00b7 (tentative d'exploit)",
    "target_port_label": "19975 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 61
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 19975,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 19975,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:19975 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:19975\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "target_port_label": "19975 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "19975"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}