{"ip":"207.154.210.146","exported_at":"2026-07-28T13:09:29+00:00","period_days":30,"metrics":{"events7d":140,"distinct_ports":2,"distinct_classifications":5,"max_severity":6,"last_sensor_id":"paris-1","max_waf_score":3,"max_risk_score":44,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["cloud_infra_scan"],"recommended_action":"monitor","confidence":0.5,"risk_breakdown":{"waf":8,"classification":62,"behavior":0,"geo":40,"protocol":30,"novelty":25},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":140,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 35\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":62,"behavior":0,"geo":40,"protocol":30,"novelty":25,"risk_score":35},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":50,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0554"],"tags_summary":["pat-0554"],"attack_vector":"kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000f\ufffd5\ufffd\u0016\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\t\u0007gsuk\ufffd\u0682\u001a }\ufffd\u0026\u0013p#\ufffdH\ufffd\ufffd\u0000\ufffd|\ufffd5\ufffd.\ufffd\ufffd\u0022\u0188\ufffd\u0015\u0015\u000e\f\u0000\ufffd\tJ\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u00003\u00009\u00005\u0000\/\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd","port":6443,"service":"k8s-api","service_label_fr":"K8S API"},"protocol_summary_fr":"Payload \u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u000f\ufffd5\ufffd\u0016\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\t\u0007gsuk\ufffd\u0682\u001a }\ufffd\u0026\u0013p#\ufffdH\ufffd\ufffd\u0000\ufffd|\ufffd5\ufffd.\ufffd\ufffd\u0022\u0188\u2026 \u00b7 K8S API:6443","evidence_snippet":"\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\tgsuk\ufffd\u0682 }\ufffd\u0026p#\ufffdH\ufffd\ufffd\ufffd|\ufffd5\ufffd.\ufffd\ufffd\u0022\u0188\ufffd\ufffd\tJ\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd","target_port_label":"6443 \u00b7 K8S API","emulator_service":"k8s-api","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 50 % \u2014 Score WAF 8","payload_preview":"\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\tgsuk\ufffd\u0682 }\ufffd\u0026p#\ufffdH\ufffd\ufffd\ufffd|\ufffd5\ufffd.\ufffd\ufffd\u0022\u0188\ufffd\ufffd\tJ\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd"},"events":[{"id":14031854,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":25323,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.863626401475841, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222b3d37b2a6c34cbdf5b39663ec3ab013\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003DlH[p\ufffd\u04f5P]\ufffd\ufffd:\ufffdo\\u0015\\u001e\u01ee\\u0019\ufffdO\ufffdf\ufffd\ufffdL\ufffd\ufffdDqR \u05b6*\ufffd8\ufffd\ufffdCG\ufffd\ufffdE\ufffd \u0524\ufffd\ufffd\ufffdkd\ufffd\u02e1\ufffdA\u0351\ufffd\\u001b:%\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003DlH[p\ufffd\u04f5P]\ufffd\ufffd:\ufffdo\\u0015\\u001e\u01ee\\u0019\ufffdO\ufffdf\ufffd\ufffdL\ufffd\ufffdDqR \u05b6*\ufffd8\ufffd\ufffdCG\ufffd\ufffdE\ufffd \u0524\ufffd\ufffd\ufffdkd\ufffd\u02e1\ufffdA\u0351\ufffd\\u001b:%\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003DlH[p\ufffd\u04f5P]\ufffd\ufffd:\ufffdo\\u0015\\u001e\u01ee\\u0019\ufffdO\ufffdf\ufffd\ufffdL\ufffd\ufffdDqR \u05b6*\ufffd8\ufffd\ufffdCG\ufffd\ufffdE\ufffd \u0524\ufffd\ufffd\ufffdkd\ufffd\u02e1\ufffdA\u0351\ufffd\\u001b:%\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003DlH[p\ufffd\u04f5P]\ufffd\ufffd:\ufffdo\\u0015\\u001e\u01ee\\u0019\ufffdO\ufffdf\ufffd\ufffdL\ufffd\ufffdDqR \u05b6*\ufffd8\ufffd\ufffdCG\ufffd\ufffdE\ufffd \u0524\ufffd\ufffd\ufffdkd\ufffd\u02e1\ufffdA\u0351\ufffd\\u001b:%\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003DlH[p\ufffd\u04f5P]\ufffd\ufffd:\ufffdo\\u0015\\u001e\u01ee\\u0019\ufffdO\ufffdf\ufffd\ufffdL\ufffd\ufffdDqR \u05b6*\ufffd8\ufffd\ufffdCG\ufffd\ufffdE\ufffd \u0524\ufffd\ufffd\ufffdkd\ufffd\u02e1\ufffdA\u0351\ufffd\\u001b:%\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228223b17d275caf7530bdf21fb3e46ab7202b18d8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003DlH[p\ufffd\u04f5P]\ufffd\ufffd:\ufffdo\\u0015\\u001e\u01ee\\u0019\ufffdO\ufffdf\ufffd\ufffdL\ufffd\ufffdDqR \u05b6*\ufffd8\ufffd\ufffdCG\ufffd\ufffdE\ufffd \u0524\ufffd\ufffd\ufffdkd\ufffd\u02e1\ufffdA\u0351\ufffd\\u001b:%\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdDlH[p\ufffd\u04f5P]\ufffd\ufffd:\ufffdo\u01ee\ufffdO\ufffdf\ufffd\ufffdL\ufffd\ufffdDqR \u05b6*\ufffd8\ufffd\ufffdCG\ufffd\ufffdE\ufffd \u0524\ufffd\ufffd\ufffdkd\ufffd\u02e1\ufffdA\u0351\ufffd:%\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003DlH[p\ufffd\u04f5P]\ufffd\ufffd:\ufffdo\\u0015\\u001e\u01ee\\u0019\ufffdO\ufffdf\ufffd\ufffdL\ufffd\ufffdDqR \u05b6*\ufffd8\ufffd\ufffdCG\ufffd\ufffdE\ufffd \u0524\ufffd\ufffd\ufffdkd\ufffd\u02e1\ufffdA\u0351\ufffd\\u001b:%\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdDlH[p\ufffd\u04f5P]\ufffd\ufffd:\ufffdo\u01ee\ufffdO\ufffdf\ufffd\ufffdL\ufffd\ufffdDqR \u05b6*\ufffd8\ufffd\ufffdCG\ufffd\ufffdE\ufffd \u0524\ufffd\ufffd\ufffdkd\ufffd\u02e1\ufffdA\u0351\ufffd:%\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031855,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":14833,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.837232797874162, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229b7d979b0ba464b5bcadf108c87aef6d\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u003Cwo\\u001e\ufffd\\u0016\\u000f\u0614\ufffdO5\\u0016?\ufffd\u028e\ufffd\\u000fXf\ufffd\\u0006\ufffd\ufffd\uad11\ufffd\/\u07a6 \ufffd\\b\\u0016\ufffd\ufffd?~\\u000f:+\ufffd\ufffd9\ufffd:\ufffd\ufffd\ufffd\u0026\\u0017\ufffd\/\ufffdZpU!\\u001c\\u0015\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u003Cwo\\u001e\ufffd\\u0016\\u000f\u0614\ufffdO5\\u0016?\ufffd\u028e\ufffd\\u000fXf\ufffd\\u0006\ufffd\ufffd\uad11\ufffd\/\u07a6 \ufffd\\b\\u0016\ufffd\ufffd?~\\u000f:+\ufffd\ufffd9\ufffd:\ufffd\ufffd\ufffd\u0026\\u0017\ufffd\/\ufffdZpU!\\u001c\\u0015\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u003Cwo\\u001e\ufffd\\u0016\\u000f\u0614\ufffdO5\\u0016?\ufffd\u028e\ufffd\\u000fXf\ufffd\\u0006\ufffd\ufffd\uad11\ufffd\/\u07a6 \ufffd\\b\\u0016\ufffd\ufffd?~\\u000f:+\ufffd\ufffd9\ufffd:\ufffd\ufffd\ufffd\u0026\\u0017\ufffd\/\ufffdZpU!\\u001c\\u0015\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022321006e3997d5857c955e5ddecfbdac21a3335bb\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u003Cwo\\u001e\ufffd\\u0016\\u000f\u0614\ufffdO5\\u0016?\ufffd\u028e\ufffd\\u000fXf\ufffd\\u0006\ufffd\ufffd\uad11\ufffd\/\u07a6 \ufffd\\b\\u0016\ufffd\ufffd?~\\u000f:+\ufffd\ufffd9\ufffd:\ufffd\ufffd\ufffd\u0026\\u0017\ufffd\/\ufffdZpU!\\u001c\\u0015\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\u003Cwo\ufffd\u0614\ufffdO5?\ufffd\u028e\ufffdXf\ufffd\ufffd\ufffd\uad11\ufffd\/\u07a6 \ufffd\ufffd\ufffd?~:+\ufffd\ufffd9\ufffd:\ufffd\ufffd\ufffd\u0026\ufffd\/\ufffdZpU!\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u003Cwo\\u001e\ufffd\\u0016\\u000f\u0614\ufffdO5\\u0016?\ufffd\u028e\ufffd\\u000fXf\ufffd\\u0006\ufffd\ufffd\uad11\ufffd\/\u07a6 \ufffd\\b\\u0016\ufffd\ufffd?~\\u000f:+\ufffd\ufffd9\ufffd:\ufffd\ufffd\ufffd\u0026\\u0017\ufffd\/\ufffdZpU!\\u001c\\u0015\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\u003Cwo\ufffd\u0614\ufffdO5?\ufffd\u028e\ufffdXf\ufffd\ufffd\ufffd\uad11\ufffd\/\u07a6 \ufffd\ufffd\ufffd?~:+\ufffd\ufffd9\ufffd:\ufffd\ufffd\ufffd\u0026\ufffd\/\ufffdZpU!\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031856,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":3425,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.841088736621942, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002285ecfa7166d2cb9f0c08491fcc16844b\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001b\\u0011\\u0011\\u001f\ufffdQk\ufffd\ufffd`\\u0017d\ufffd\ufffd\ufffd\u003E\\u001cD\ufffdG\ufffd\\tOV\ufffd\\u0006G\ufffd\\u0019 b\/\ufffd\\u000b\ufffdsZ\ufffd!\\u000b\ufffd\\r\ufffd\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\u07fb\ufffd\\u000e(\\u0007$b\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001b\\u0011\\u0011\\u001f\ufffdQk\ufffd\ufffd`\\u0017d\ufffd\ufffd\ufffd\u003E\\u001cD\ufffdG\ufffd\\tOV\ufffd\\u0006G\ufffd\\u0019 b\/\ufffd\\u000b\ufffdsZ\ufffd!\\u000b\ufffd\\r\ufffd\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\u07fb\ufffd\\u000e(\\u0007$b\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001b\\u0011\\u0011\\u001f\ufffdQk\ufffd\ufffd`\\u0017d\ufffd\ufffd\ufffd\u003E\\u001cD\ufffdG\ufffd\\tOV\ufffd\\u0006G\ufffd\\u0019 b\/\ufffd\\u000b\ufffdsZ\ufffd!\\u000b\ufffd\\r\ufffd\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\u07fb\ufffd\\u000e(\\u0007$b\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002219cf7efa7c56887a3c772e39fdefbb6de7a28e70\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001b\\u0011\\u0011\\u001f\ufffdQk\ufffd\ufffd`\\u0017d\ufffd\ufffd\ufffd\u003E\\u001cD\ufffdG\ufffd\\tOV\ufffd\\u0006G\ufffd\\u0019 b\/\ufffd\\u000b\ufffdsZ\ufffd!\\u000b\ufffd\\r\ufffd\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\u07fb\ufffd\\u000e(\\u0007$b\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdQk\ufffd\ufffd`d\ufffd\ufffd\ufffd\u003ED\ufffdG\ufffd\\tOV\ufffdG\ufffd b\/\ufffd\ufffdsZ\ufffd!\ufffd\\r\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\u07fb\ufffd($b\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001b\\u0011\\u0011\\u001f\ufffdQk\ufffd\ufffd`\\u0017d\ufffd\ufffd\ufffd\u003E\\u001cD\ufffdG\ufffd\\tOV\ufffd\\u0006G\ufffd\\u0019 b\/\ufffd\\u000b\ufffdsZ\ufffd!\\u000b\ufffd\\r\ufffd\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\u07fb\ufffd\\u000e(\\u0007$b\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdQk\ufffd\ufffd`d\ufffd\ufffd\ufffd\u003ED\ufffdG\ufffd\\tOV\ufffdG\ufffd b\/\ufffd\ufffdsZ\ufffd!\ufffd\\r\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\u07fb\ufffd($b\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031857,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":32415,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.856529817893108, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00221c4eb9ecfe290cb209666f3b417d4759\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdX\\u0017R\ufffdB\ufffd\\u0001\\u0006F\u05de\\u0011\ufffd1\ufffd\ufffdY\\u001c4\ufffd\\u0017\ufffddp\ufffd\ufffd%4~\\u0012N @@?\ufffd\ufffdn\ufffdG6f\u04a7\ufffd\ufffd\\u0019\ufffdH\ufffd1+\\u001b|S\ufffdW~l\ufffd@v,\\u001c\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdX\\u0017R\ufffdB\ufffd\\u0001\\u0006F\u05de\\u0011\ufffd1\ufffd\ufffdY\\u001c4\ufffd\\u0017\ufffddp\ufffd\ufffd%4~\\u0012N @@?\ufffd\ufffdn\ufffdG6f\u04a7\ufffd\ufffd\\u0019\ufffdH\ufffd1+\\u001b|S\ufffdW~l\ufffd@v,\\u001c\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdX\\u0017R\ufffdB\ufffd\\u0001\\u0006F\u05de\\u0011\ufffd1\ufffd\ufffdY\\u001c4\ufffd\\u0017\ufffddp\ufffd\ufffd%4~\\u0012N @@?\ufffd\ufffdn\ufffdG6f\u04a7\ufffd\ufffd\\u0019\ufffdH\ufffd1+\\u001b|S\ufffdW~l\ufffd@v,\\u001c\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229e0744820298aa78b402d0075d0481afc717b1a1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdX\\u0017R\ufffdB\ufffd\\u0001\\u0006F\u05de\\u0011\ufffd1\ufffd\ufffdY\\u001c4\ufffd\\u0017\ufffddp\ufffd\ufffd%4~\\u0012N @@?\ufffd\ufffdn\ufffdG6f\u04a7\ufffd\ufffd\\u0019\ufffdH\ufffd1+\\u001b|S\ufffdW~l\ufffd@v,\\u001c\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdXR\ufffdB\ufffdF\u05de\ufffd1\ufffd\ufffdY4\ufffd\ufffddp\ufffd\ufffd%4~N @@?\ufffd\ufffdn\ufffdG6f\u04a7\ufffd\ufffd\ufffdH\ufffd1+|S\ufffdW~l\ufffd@v,\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdX\\u0017R\ufffdB\ufffd\\u0001\\u0006F\u05de\\u0011\ufffd1\ufffd\ufffdY\\u001c4\ufffd\\u0017\ufffddp\ufffd\ufffd%4~\\u0012N @@?\ufffd\ufffdn\ufffdG6f\u04a7\ufffd\ufffd\\u0019\ufffdH\ufffd1+\\u001b|S\ufffdW~l\ufffd@v,\\u001c\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdXR\ufffdB\ufffdF\u05de\ufffd1\ufffd\ufffdY4\ufffd\ufffddp\ufffd\ufffd%4~N @@?\ufffd\ufffdn\ufffdG6f\u04a7\ufffd\ufffd\ufffdH\ufffd1+|S\ufffdW~l\ufffd@v,\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031858,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":7913,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.843497078010408, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227a4e65fed014af74f5ca28c78cdd1a5e\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S=b\ufffdP\ufffd\\u0019w[8\ufffd7Gw \ufffd\ufffd[\ufffd\ufffd\ufffd\\u000e\\u001e\ufffdI\u0027\ufffd\ufffdD\\u000fS SP\ufffdu^\ufffd9\ufffd\\u0011\\u000b\ufffd\u0446B\\u000f\ufffd\ufffdi\ufffd\\u001a\\u001a\ufffd\\u0006%\\u0016E\\t\ufffd\ufffdJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S=b\ufffdP\ufffd\\u0019w[8\ufffd7Gw \ufffd\ufffd[\ufffd\ufffd\ufffd\\u000e\\u001e\ufffdI\u0027\ufffd\ufffdD\\u000fS SP\ufffdu^\ufffd9\ufffd\\u0011\\u000b\ufffd\u0446B\\u000f\ufffd\ufffdi\ufffd\\u001a\\u001a\ufffd\\u0006%\\u0016E\\t\ufffd\ufffdJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S=b\ufffdP\ufffd\\u0019w[8\ufffd7Gw \ufffd\ufffd[\ufffd\ufffd\ufffd\\u000e\\u001e\ufffdI\u0027\ufffd\ufffdD\\u000fS SP\ufffdu^\ufffd9\ufffd\\u0011\\u000b\ufffd\u0446B\\u000f\ufffd\ufffdi\ufffd\\u001a\\u001a\ufffd\\u0006%\\u0016E\\t\ufffd\ufffdJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ac8ee11a6240c1fc53adf8d345f627f8cc2aa298\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S=b\ufffdP\ufffd\\u0019w[8\ufffd7Gw \ufffd\ufffd[\ufffd\ufffd\ufffd\\u000e\\u001e\ufffdI\u0027\ufffd\ufffdD\\u000fS SP\ufffdu^\ufffd9\ufffd\\u0011\\u000b\ufffd\u0446B\\u000f\ufffd\ufffdi\ufffd\\u001a\\u001a\ufffd\\u0006%\\u0016E\\t\ufffd\ufffdJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdS=b\ufffdP\ufffdw[8\ufffd7Gw \ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdI\u0027\ufffd\ufffdDS SP\ufffdu^\ufffd9\ufffd\ufffd\u0446B\ufffd\ufffdi\ufffd\ufffd%E\\t\ufffd\ufffdJ\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S=b\ufffdP\ufffd\\u0019w[8\ufffd7Gw \ufffd\ufffd[\ufffd\ufffd\ufffd\\u000e\\u001e\ufffdI\u0027\ufffd\ufffdD\\u000fS SP\ufffdu^\ufffd9\ufffd\\u0011\\u000b\ufffd\u0446B\\u000f\ufffd\ufffdi\ufffd\\u001a\\u001a\ufffd\\u0006%\\u0016E\\t\ufffd\ufffdJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdS=b\ufffdP\ufffdw[8\ufffd7Gw \ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdI\u0027\ufffd\ufffdDS SP\ufffdu^\ufffd9\ufffd\ufffd\u0446B\ufffd\ufffdi\ufffd\ufffd%E\\t\ufffd\ufffdJ\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031859,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":5561,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.866181967869204, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226d95add08ada81e7ca1b83448fc9a214\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd)\\u0003O1\ufffdr^\ufffd:\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd%\ufffdX\ufffd\ufffd\ufffd5\ufffdl\ufffdV I\ufffd\\u0002\ufffd\\u0006\\u0017\u0026he\ufffdUg\ufffd=\ufffd\ufffdR\ufffdlG\ufffd \ufffd\ufffdJ\\u0011\ufffd.[7\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd)\\u0003O1\ufffdr^\ufffd:\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd%\ufffdX\ufffd\ufffd\ufffd5\ufffdl\ufffdV I\ufffd\\u0002\ufffd\\u0006\\u0017\u0026he\ufffdUg\ufffd=\ufffd\ufffdR\ufffdlG\ufffd \ufffd\ufffdJ\\u0011\ufffd.[7\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd)\\u0003O1\ufffdr^\ufffd:\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd%\ufffdX\ufffd\ufffd\ufffd5\ufffdl\ufffdV I\ufffd\\u0002\ufffd\\u0006\\u0017\u0026he\ufffdUg\ufffd=\ufffd\ufffdR\ufffdlG\ufffd \ufffd\ufffdJ\\u0011\ufffd.[7\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ebeef5a45e1d69bfa4b407b55428bff61b5bc718\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd)\\u0003O1\ufffdr^\ufffd:\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd%\ufffdX\ufffd\ufffd\ufffd5\ufffdl\ufffdV I\ufffd\\u0002\ufffd\\u0006\\u0017\u0026he\ufffdUg\ufffd=\ufffd\ufffdR\ufffdlG\ufffd \ufffd\ufffdJ\\u0011\ufffd.[7\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd)O1\ufffdr^\ufffd:\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffdX\ufffd\ufffd\ufffd5\ufffdl\ufffdV I\ufffd\ufffd\u0026he\ufffdUg\ufffd=\ufffd\ufffdR\ufffdlG\ufffd \ufffd\ufffdJ\ufffd.[7\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd)\\u0003O1\ufffdr^\ufffd:\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\\u0003\ufffd%\ufffdX\ufffd\ufffd\ufffd5\ufffdl\ufffdV I\ufffd\\u0002\ufffd\\u0006\\u0017\u0026he\ufffdUg\ufffd=\ufffd\ufffdR\ufffdlG\ufffd \ufffd\ufffdJ\\u0011\ufffd.[7\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd)O1\ufffdr^\ufffd:\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd%\ufffdX\ufffd\ufffd\ufffd5\ufffdl\ufffdV I\ufffd\ufffd\u0026he\ufffdUg\ufffd=\ufffd\ufffdR\ufffdlG\ufffd \ufffd\ufffdJ\ufffd.[7\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031860,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":19037,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.837881954696472, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223d848b8d4b8da9c909e5ba51221d35b0\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u000b\u0027J\ufffddb\/\\u0010\ufffd\ufffd\ufffd,\ufffd\\r?\ufffd\ufffd\ufffd\ufffdb\\u0001#R\\u001b\ufffd\ufffd\ufffd\\n\\u0007\ufffd\\u0019\\u001b \ufffdw\ufffd;\ufffd\ufffd\ufffdzu*\ufffd\ufffd\ufffdWAy\ufffd\ufffdi\ufffd\u0681\ufffdorP*\ufffd*Ue\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u000b\u0027J\ufffddb\/\\u0010\ufffd\ufffd\ufffd,\ufffd\\r?\ufffd\ufffd\ufffd\ufffdb\\u0001#R\\u001b\ufffd\ufffd\ufffd\\n\\u0007\ufffd\\u0019\\u001b \ufffdw\ufffd;\ufffd\ufffd\ufffdzu*\ufffd\ufffd\ufffdWAy\ufffd\ufffdi\ufffd\u0681\ufffdorP*\ufffd*Ue\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u000b\u0027J\ufffddb\/\\u0010\ufffd\ufffd\ufffd,\ufffd\\r?\ufffd\ufffd\ufffd\ufffdb\\u0001#R\\u001b\ufffd\ufffd\ufffd\\n\\u0007\ufffd\\u0019\\u001b \ufffdw\ufffd;\ufffd\ufffd\ufffdzu*\ufffd\ufffd\ufffdWAy\ufffd\ufffdi\ufffd\u0681\ufffdorP*\ufffd*Ue\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c514e4b2c46d4200e7b8dd69432cb838eac5e657\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u000b\u0027J\ufffddb\/\\u0010\ufffd\ufffd\ufffd,\ufffd\\r?\ufffd\ufffd\ufffd\ufffdb\\u0001#R\\u001b\ufffd\ufffd\ufffd\\n\\u0007\ufffd\\u0019\\u001b \ufffdw\ufffd;\ufffd\ufffd\ufffdzu*\ufffd\ufffd\ufffdWAy\ufffd\ufffdi\ufffd\u0681\ufffdorP*\ufffd*Ue\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\u0027J\ufffddb\/\ufffd\ufffd\ufffd,\ufffd\\r?\ufffd\ufffd\ufffd\ufffdb#R\ufffd\ufffd\ufffd\\n\ufffd \ufffdw\ufffd;\ufffd\ufffd\ufffdzu*\ufffd\ufffd\ufffdWAy\ufffd\ufffdi\ufffd\u0681\ufffdorP*\ufffd*Ue\u003E\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u000b\u0027J\ufffddb\/\\u0010\ufffd\ufffd\ufffd,\ufffd\\r?\ufffd\ufffd\ufffd\ufffdb\\u0001#R\\u001b\ufffd\ufffd\ufffd\\n\\u0007\ufffd\\u0019\\u001b \ufffdw\ufffd;\ufffd\ufffd\ufffdzu*\ufffd\ufffd\ufffdWAy\ufffd\ufffdi\ufffd\u0681\ufffdorP*\ufffd*Ue\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\u0027J\ufffddb\/\ufffd\ufffd\ufffd,\ufffd\\r?\ufffd\ufffd\ufffd\ufffdb#R\ufffd\ufffd\ufffd\\n\ufffd \ufffdw\ufffd;\ufffd\ufffd\ufffdzu*\ufffd\ufffd\ufffdWAy\ufffd\ufffdi\ufffd\u0681\ufffdorP*\ufffd*Ue\u003E\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031861,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":11679,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.896546227411344, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d34216734d079620faf09bfdb77b8935\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u054a\ufffd\ufffd~=\\u0013\ufffd0\ufffd\ufffd\ufffd`\ufffd\ufffdGr\\u0019\ufffd\ufffd\ufffd\ufffd*NF+%\\t\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffda@\ufffd\ufffdW\u043b\ufffdA4\\u001c[\ufffd\\f\ufffd\ufffdO7\u003EMc\ufffd@\ufffd\ufffd)5\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u054a\ufffd\ufffd~=\\u0013\ufffd0\ufffd\ufffd\ufffd`\ufffd\ufffdGr\\u0019\ufffd\ufffd\ufffd\ufffd*NF+%\\t\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffda@\ufffd\ufffdW\u043b\ufffdA4\\u001c[\ufffd\\f\ufffd\ufffdO7\u003EMc\ufffd@\ufffd\ufffd)5\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u054a\ufffd\ufffd~=\\u0013\ufffd0\ufffd\ufffd\ufffd`\ufffd\ufffdGr\\u0019\ufffd\ufffd\ufffd\ufffd*NF+%\\t\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffda@\ufffd\ufffdW\u043b\ufffdA4\\u001c[\ufffd\\f\ufffd\ufffdO7\u003EMc\ufffd@\ufffd\ufffd)5\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u054a\ufffd\ufffd~=\\u0013\ufffd0\ufffd\ufffd\ufffd`\ufffd\ufffdGr\\u0019\ufffd\ufffd\ufffd\ufffd*NF+%\\t\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffda@\ufffd\ufffdW\u043b\ufffdA4\\u001c[\ufffd\\f\ufffd\ufffdO7\u003EMc\ufffd@\ufffd\ufffd)5\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u054a\ufffd\ufffd~=\\u0013\ufffd0\ufffd\ufffd\ufffd`\ufffd\ufffdGr\\u0019\ufffd\ufffd\ufffd\ufffd*NF+%\\t\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffda@\ufffd\ufffdW\u043b\ufffdA4\\u001c[\ufffd\\f\ufffd\ufffdO7\u003EMc\ufffd@\ufffd\ufffd)5\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022111872cd9e1677b1ecd9c629dab8e40f998412ae\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u054a\ufffd\ufffd~=\\u0013\ufffd0\ufffd\ufffd\ufffd`\ufffd\ufffdGr\\u0019\ufffd\ufffd\ufffd\ufffd*NF+%\\t\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffda@\ufffd\ufffdW\u043b\ufffdA4\\u001c[\ufffd\\f\ufffd\ufffdO7\u003EMc\ufffd@\ufffd\ufffd)5\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\u054a\ufffd\ufffd~=\ufffd0\ufffd\ufffd\ufffd`\ufffd\ufffdGr\ufffd\ufffd\ufffd\ufffd*NF+%\\t\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffda@\ufffd\ufffdW\u043b\ufffdA4[\ufffd\ufffd\ufffdO7\u003EMc\ufffd@\ufffd\ufffd)5\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u054a\ufffd\ufffd~=\\u0013\ufffd0\ufffd\ufffd\ufffd`\ufffd\ufffdGr\\u0019\ufffd\ufffd\ufffd\ufffd*NF+%\\t\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffda@\ufffd\ufffdW\u043b\ufffdA4\\u001c[\ufffd\\f\ufffd\ufffdO7\u003EMc\ufffd@\ufffd\ufffd)5\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\u054a\ufffd\ufffd~=\ufffd0\ufffd\ufffd\ufffd`\ufffd\ufffdGr\ufffd\ufffd\ufffd\ufffd*NF+%\\t\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd6\ufffd\ufffda@\ufffd\ufffdW\u043b\ufffdA4[\ufffd\ufffd\ufffdO7\u003EMc\ufffd@\ufffd\ufffd)5\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031862,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":32655,"dst_port":6443,"service":"k8s-api","classification":"dnp3_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.8419426721018155, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022confidence\u0022: 0.51, \u0022classification_confidence\u0022: 0.51, \u0022precision_score\u0022: 60, \u0022precision_signals\u0022: [\u0022pat-0794\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0794\u0022], \u0022matched_patterns\u0022: [\u0022pat-0794\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Sigma DNP3 link\u0022, \u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0794\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 51.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002213c33777570db426a5d52ac4c4de56a6\u0022, \u0022path_pattern_hash\u0022: \u0022859b07b9d78548343d57aca7faf5fc6a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\tZT\\u001a\ufffd$\ufffd\\u000e\ufffd\ufffd\ufffd%\ufffd\/\\u0003\ufffd\ufffd\ufffd,\ufffd\ufffd@\\u0000\ufffd\ufffda\u003C\ufffd99 \ufffd\ufffd`Z\\u0005d3\\u0010LL\ufffd\\u001e\ufffd\ufffdY\\u0012U`\ufffdc\ufffd\ufffds\ufffd\\u0007\ufffd\ufffdv\ufffd\\u0003\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\tZT\\u001a\ufffd$\ufffd\\u000e\ufffd\ufffd\ufffd%\ufffd\/\\u0003\ufffd\ufffd\ufffd,\ufffd\ufffd@\\u0000\ufffd\ufffda\u003C\ufffd99 \ufffd\ufffd`Z\\u0005d3\\u0010LL\ufffd\\u001e\ufffd\ufffdY\\u0012U`\ufffdc\ufffd\ufffds\ufffd\\u0007\ufffd\ufffdv\ufffd\\u0003\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\tZT\\u001a\ufffd$\ufffd\\u000e\ufffd\ufffd\ufffd%\ufffd\/\\u0003\ufffd\ufffd\ufffd,\ufffd\ufffd@\\u0000\ufffd\ufffda\u003C\ufffd99 \ufffd\ufffd`Z\\u0005d3\\u0010LL\ufffd\\u001e\ufffd\ufffdY\\u0012U`\ufffdc\ufffd\ufffds\ufffd\\u0007\ufffd\ufffdv\ufffd\\u0003\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022ics_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222f2d9815da71fbc467bd7c8cb2f91c12d0c313b9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\tZT\\u001a\ufffd$\ufffd\\u000e\ufffd\ufffd\ufffd%\ufffd\/\\u0003\ufffd\ufffd\ufffd,\ufffd\ufffd@\\u0000\ufffd\ufffda\u003C\ufffd99 \ufffd\ufffd`Z\\u0005d3\\u0010LL\ufffd\\u001e\ufffd\ufffdY\\u0012U`\ufffdc\ufffd\ufffds\ufffd\\u0007\ufffd\ufffdv\ufffd\\u0003\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\tZT\ufffd$\ufffd\ufffd\ufffd\ufffd%\ufffd\/\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd\ufffda\u003C\ufffd99 \ufffd\ufffd`Zd3LL\ufffd\ufffd\ufffdYU`\ufffdc\ufffd\ufffds\ufffd\ufffd\ufffdv\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022dnp3 probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 51, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0794\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0794\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\tZT\\u001a\ufffd$\ufffd\\u000e\ufffd\ufffd\ufffd%\ufffd\/\\u0003\ufffd\ufffd\ufffd,\ufffd\ufffd@\\u0000\ufffd\ufffda\u003C\ufffd99 \ufffd\ufffd`Z\\u0005d3\\u0010LL\ufffd\\u001e\ufffd\ufffdY\\u0012U`\ufffdc\ufffd\ufffds\ufffd\\u0007\ufffd\ufffdv\ufffd\\u0003\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022dnp3 probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\tZT\ufffd$\ufffd\ufffd\ufffd\ufffd%\ufffd\/\ufffd\ufffd\ufffd,\ufffd\ufffd@\ufffd\ufffda\u003C\ufffd99 \ufffd\ufffd`Zd3LL\ufffd\ufffd\ufffdYU`\ufffdc\ufffd\ufffds\ufffd\ufffd\ufffdv\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 51 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031863,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":10123,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.884705005730486, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b48949306cc0510b4b65827f0d21e374\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001c,\ufffdN\ufffd\\u0015\ufffd\\fy\ufffd\ufffd\ufffd\/{W\ufffd\u0171\ufffd\ufffdD\u0692\ufffd)dOM\ufffd\ufffd\ufffd \ufffd8\ufffd\ufffd\ufffdnx\ufffd\ufffd{\ufffd\\u0002\ufffd[\ufffd\ufffd\ufffd[\ufffdAi\ufffd\ufffd\ufffd\ufffd4\ufffdJ\ufffd\ufffd \ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001c,\ufffdN\ufffd\\u0015\ufffd\\fy\ufffd\ufffd\ufffd\/{W\ufffd\u0171\ufffd\ufffdD\u0692\ufffd)dOM\ufffd\ufffd\ufffd \ufffd8\ufffd\ufffd\ufffdnx\ufffd\ufffd{\ufffd\\u0002\ufffd[\ufffd\ufffd\ufffd[\ufffdAi\ufffd\ufffd\ufffd\ufffd4\ufffdJ\ufffd\ufffd \ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001c,\ufffdN\ufffd\\u0015\ufffd\\fy\ufffd\ufffd\ufffd\/{W\ufffd\u0171\ufffd\ufffdD\u0692\ufffd)dOM\ufffd\ufffd\ufffd \ufffd8\ufffd\ufffd\ufffdnx\ufffd\ufffd{\ufffd\\u0002\ufffd[\ufffd\ufffd\ufffd[\ufffdAi\ufffd\ufffd\ufffd\ufffd4\ufffdJ\ufffd\ufffd \ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022506818bfa5ca947410fa6863fd9a9d2163ba03c6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001c,\ufffdN\ufffd\\u0015\ufffd\\fy\ufffd\ufffd\ufffd\/{W\ufffd\u0171\ufffd\ufffdD\u0692\ufffd)dOM\ufffd\ufffd\ufffd \ufffd8\ufffd\ufffd\ufffdnx\ufffd\ufffd{\ufffd\\u0002\ufffd[\ufffd\ufffd\ufffd[\ufffdAi\ufffd\ufffd\ufffd\ufffd4\ufffdJ\ufffd\ufffd \ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd,\ufffdN\ufffd\ufffdy\ufffd\ufffd\ufffd\/{W\ufffd\u0171\ufffd\ufffdD\u0692\ufffd)dOM\ufffd\ufffd\ufffd \ufffd8\ufffd\ufffd\ufffdnx\ufffd\ufffd{\ufffd\ufffd[\ufffd\ufffd\ufffd[\ufffdAi\ufffd\ufffd\ufffd\ufffd4\ufffdJ\ufffd\ufffd \ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001c,\ufffdN\ufffd\\u0015\ufffd\\fy\ufffd\ufffd\ufffd\/{W\ufffd\u0171\ufffd\ufffdD\u0692\ufffd)dOM\ufffd\ufffd\ufffd \ufffd8\ufffd\ufffd\ufffdnx\ufffd\ufffd{\ufffd\\u0002\ufffd[\ufffd\ufffd\ufffd[\ufffdAi\ufffd\ufffd\ufffd\ufffd4\ufffdJ\ufffd\ufffd \ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd,\ufffdN\ufffd\ufffdy\ufffd\ufffd\ufffd\/{W\ufffd\u0171\ufffd\ufffdD\u0692\ufffd)dOM\ufffd\ufffd\ufffd \ufffd8\ufffd\ufffd\ufffdnx\ufffd\ufffd{\ufffd\ufffd[\ufffd\ufffd\ufffd[\ufffdAi\ufffd\ufffd\ufffd\ufffd4\ufffdJ\ufffd\ufffd \ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031864,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":18197,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.82236868912645, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f7772f1afdf88ccf6f4819c995a5f365\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003k\ufffd\ufffd\ufffd\ufffd}\ufffdZ\ufffd\ufffd\u7052\\n\ufffdcX\ufffd\u013e\ufffd\ufffdSnZ\ufffd5\ufffd\ufffd\ufffd ]\ufffd\\u0016\ufffd\ufffd\ufffdQ\ufffdN\\u001d\ufffd\ufffd\\u0001\ufffd\ufffdF`\\u0001\u003Eo\\u0017\ufffd\\t:E\ufffd\ufffda\ufffd\ufffd\ufffd:\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003k\ufffd\ufffd\ufffd\ufffd}\ufffdZ\ufffd\ufffd\u7052\\n\ufffdcX\ufffd\u013e\ufffd\ufffdSnZ\ufffd5\ufffd\ufffd\ufffd ]\ufffd\\u0016\ufffd\ufffd\ufffdQ\ufffdN\\u001d\ufffd\ufffd\\u0001\ufffd\ufffdF`\\u0001\u003Eo\\u0017\ufffd\\t:E\ufffd\ufffda\ufffd\ufffd\ufffd:\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003k\ufffd\ufffd\ufffd\ufffd}\ufffdZ\ufffd\ufffd\u7052\\n\ufffdcX\ufffd\u013e\ufffd\ufffdSnZ\ufffd5\ufffd\ufffd\ufffd ]\ufffd\\u0016\ufffd\ufffd\ufffdQ\ufffdN\\u001d\ufffd\ufffd\\u0001\ufffd\ufffdF`\\u0001\u003Eo\\u0017\ufffd\\t:E\ufffd\ufffda\ufffd\ufffd\ufffd:\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022be97daf49b07d42f98fd40edad5199e3eea56679\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003k\ufffd\ufffd\ufffd\ufffd}\ufffdZ\ufffd\ufffd\u7052\\n\ufffdcX\ufffd\u013e\ufffd\ufffdSnZ\ufffd5\ufffd\ufffd\ufffd ]\ufffd\\u0016\ufffd\ufffd\ufffdQ\ufffdN\\u001d\ufffd\ufffd\\u0001\ufffd\ufffdF`\\u0001\u003Eo\\u0017\ufffd\\t:E\ufffd\ufffda\ufffd\ufffd\ufffd:\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdk\ufffd\ufffd\ufffd\ufffd}\ufffdZ\ufffd\ufffd\u7052\\n\ufffdcX\ufffd\u013e\ufffd\ufffdSnZ\ufffd5\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\ufffdQ\ufffdN\ufffd\ufffd\ufffd\ufffdF`\u003Eo\ufffd\\t:E\ufffd\ufffda\ufffd\ufffd\ufffd:\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003k\ufffd\ufffd\ufffd\ufffd}\ufffdZ\ufffd\ufffd\u7052\\n\ufffdcX\ufffd\u013e\ufffd\ufffdSnZ\ufffd5\ufffd\ufffd\ufffd ]\ufffd\\u0016\ufffd\ufffd\ufffdQ\ufffdN\\u001d\ufffd\ufffd\\u0001\ufffd\ufffdF`\\u0001\u003Eo\\u0017\ufffd\\t:E\ufffd\ufffda\ufffd\ufffd\ufffd:\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdk\ufffd\ufffd\ufffd\ufffd}\ufffdZ\ufffd\ufffd\u7052\\n\ufffdcX\ufffd\u013e\ufffd\ufffdSnZ\ufffd5\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\ufffdQ\ufffdN\ufffd\ufffd\ufffd\ufffdF`\u003Eo\ufffd\\t:E\ufffd\ufffda\ufffd\ufffd\ufffd:\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031865,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":9907,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.847458336392348, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ed20e4048001b78f8abef10a7bbafcfc\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003{\ufffd\\u001d\ufffd\ufffd\ufffd8R\ufffd\ufffd\ufffdS\ufffd\ufffd`\\u0014!\\u0001\ufffdx\\u0013\ufffd\ufffdH\\u0005\ufffdJ\u02ad\ufffd_\ufffd \\t\ufffdf\ufffd\ufffd\\r\u0157\\u0012\u0253G|\ufffd\\u0019\ufffdk\\u0016\\u0001b\\u0012?\ufffd\ufffd:\ufffd\ufffdUln\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003{\ufffd\\u001d\ufffd\ufffd\ufffd8R\ufffd\ufffd\ufffdS\ufffd\ufffd`\\u0014!\\u0001\ufffdx\\u0013\ufffd\ufffdH\\u0005\ufffdJ\u02ad\ufffd_\ufffd \\t\ufffdf\ufffd\ufffd\\r\u0157\\u0012\u0253G|\ufffd\\u0019\ufffdk\\u0016\\u0001b\\u0012?\ufffd\ufffd:\ufffd\ufffdUln\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003{\ufffd\\u001d\ufffd\ufffd\ufffd8R\ufffd\ufffd\ufffdS\ufffd\ufffd`\\u0014!\\u0001\ufffdx\\u0013\ufffd\ufffdH\\u0005\ufffdJ\u02ad\ufffd_\ufffd \\t\ufffdf\ufffd\ufffd\\r\u0157\\u0012\u0253G|\ufffd\\u0019\ufffdk\\u0016\\u0001b\\u0012?\ufffd\ufffd:\ufffd\ufffdUln\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022be1eacf72210a27ed52fd348c3fc173837fdb1b9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003{\ufffd\\u001d\ufffd\ufffd\ufffd8R\ufffd\ufffd\ufffdS\ufffd\ufffd`\\u0014!\\u0001\ufffdx\\u0013\ufffd\ufffdH\\u0005\ufffdJ\u02ad\ufffd_\ufffd \\t\ufffdf\ufffd\ufffd\\r\u0157\\u0012\u0253G|\ufffd\\u0019\ufffdk\\u0016\\u0001b\\u0012?\ufffd\ufffd:\ufffd\ufffdUln\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd{\ufffd\ufffd\ufffd\ufffd8R\ufffd\ufffd\ufffdS\ufffd\ufffd`!\ufffdx\ufffd\ufffdH\ufffdJ\u02ad\ufffd_\ufffd \\t\ufffdf\ufffd\ufffd\\r\u0157\u0253G|\ufffd\ufffdkb?\ufffd\ufffd:\ufffd\ufffdUln\ufffdd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003{\ufffd\\u001d\ufffd\ufffd\ufffd8R\ufffd\ufffd\ufffdS\ufffd\ufffd`\\u0014!\\u0001\ufffdx\\u0013\ufffd\ufffdH\\u0005\ufffdJ\u02ad\ufffd_\ufffd \\t\ufffdf\ufffd\ufffd\\r\u0157\\u0012\u0253G|\ufffd\\u0019\ufffdk\\u0016\\u0001b\\u0012?\ufffd\ufffd:\ufffd\ufffdUln\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd{\ufffd\ufffd\ufffd\ufffd8R\ufffd\ufffd\ufffdS\ufffd\ufffd`!\ufffdx\ufffd\ufffdH\ufffdJ\u02ad\ufffd_\ufffd \\t\ufffdf\ufffd\ufffd\\r\u0157\u0253G|\ufffd\ufffdkb?\ufffd\ufffd:\ufffd\ufffdUln\ufffdd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031866,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":16219,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.828389594174792, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ff6142ec4f461cd417d79f1c600530af\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd^\ufffd\u07b8\u05686\ufffd\ufffd*\ufffdm v\ufffd?3\ufffd\ufffd\ufffd}\\u0007j\ufffd8\ufffd\ufffd3\ufffd \ufffdc\ufffd\ufffd\u019cV;C\ufffd;Z\ufffd\ufffd|\ufffd\ufffd\ufffd\\u0019\ufffd\u019e\u0503\ufffd\ufffd\ufffd6\\u0002\ufffd\\r\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd^\ufffd\u07b8\u05686\ufffd\ufffd*\ufffdm v\ufffd?3\ufffd\ufffd\ufffd}\\u0007j\ufffd8\ufffd\ufffd3\ufffd \ufffdc\ufffd\ufffd\u019cV;C\ufffd;Z\ufffd\ufffd|\ufffd\ufffd\ufffd\\u0019\ufffd\u019e\u0503\ufffd\ufffd\ufffd6\\u0002\ufffd\\r\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd^\ufffd\u07b8\u05686\ufffd\ufffd*\ufffdm v\ufffd?3\ufffd\ufffd\ufffd}\\u0007j\ufffd8\ufffd\ufffd3\ufffd \ufffdc\ufffd\ufffd\u019cV;C\ufffd;Z\ufffd\ufffd|\ufffd\ufffd\ufffd\\u0019\ufffd\u019e\u0503\ufffd\ufffd\ufffd6\\u0002\ufffd\\r\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd^\ufffd\u07b8\u05686\ufffd\ufffd*\ufffdm v\ufffd?3\ufffd\ufffd\ufffd}\\u0007j\ufffd8\ufffd\ufffd3\ufffd \ufffdc\ufffd\ufffd\u019cV;C\ufffd;Z\ufffd\ufffd|\ufffd\ufffd\ufffd\\u0019\ufffd\u019e\u0503\ufffd\ufffd\ufffd6\\u0002\ufffd\\r\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd^\ufffd\u07b8\u05686\ufffd\ufffd*\ufffdm v\ufffd?3\ufffd\ufffd\ufffd}\\u0007j\ufffd8\ufffd\ufffd3\ufffd \ufffdc\ufffd\ufffd\u019cV;C\ufffd;Z\ufffd\ufffd|\ufffd\ufffd\ufffd\\u0019\ufffd\u019e\u0503\ufffd\ufffd\ufffd6\\u0002\ufffd\\r\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225d03e6a9140b1060ce3058b2c4d7b35bf8fc8cfe\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd^\ufffd\u07b8\u05686\ufffd\ufffd*\ufffdm v\ufffd?3\ufffd\ufffd\ufffd}\\u0007j\ufffd8\ufffd\ufffd3\ufffd \ufffdc\ufffd\ufffd\u019cV;C\ufffd;Z\ufffd\ufffd|\ufffd\ufffd\ufffd\\u0019\ufffd\u019e\u0503\ufffd\ufffd\ufffd6\\u0002\ufffd\\r\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd^\ufffd\u07b8\u05686\ufffd\ufffd*\ufffdm v\ufffd?3\ufffd\ufffd\ufffd}j\ufffd8\ufffd\ufffd3\ufffd \ufffdc\ufffd\ufffd\u019cV;C\ufffd;Z\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd\u019e\u0503\ufffd\ufffd\ufffd6\ufffd\\r\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd^\ufffd\u07b8\u05686\ufffd\ufffd*\ufffdm v\ufffd?3\ufffd\ufffd\ufffd}\\u0007j\ufffd8\ufffd\ufffd3\ufffd \ufffdc\ufffd\ufffd\u019cV;C\ufffd;Z\ufffd\ufffd|\ufffd\ufffd\ufffd\\u0019\ufffd\u019e\u0503\ufffd\ufffd\ufffd6\\u0002\ufffd\\r\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd^\ufffd\u07b8\u05686\ufffd\ufffd*\ufffdm v\ufffd?3\ufffd\ufffd\ufffd}j\ufffd8\ufffd\ufffd3\ufffd \ufffdc\ufffd\ufffd\u019cV;C\ufffd;Z\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd\u019e\u0503\ufffd\ufffd\ufffd6\ufffd\\r\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031867,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":28265,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.885214911067199, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e70578b2b07faa78a711d6f1120195e5\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffde\\r\u071d\ufffd\ufffd\ufffd\ufffd\ufffd \\u0004^\ufffd\ufffdzE\ufffd#a\ufffd\ufffdyi3N\ufffd\u01e4*\\u0010 6t\ufffd\ufffd\\u0013\ufffdA^:\\u001d_\/EH\ufffdJW#\\u001fQ\ufffd;\u0287\u003Eg.\ufffd|\ufffdF\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffde\\r\u071d\ufffd\ufffd\ufffd\ufffd\ufffd \\u0004^\ufffd\ufffdzE\ufffd#a\ufffd\ufffdyi3N\ufffd\u01e4*\\u0010 6t\ufffd\ufffd\\u0013\ufffdA^:\\u001d_\/EH\ufffdJW#\\u001fQ\ufffd;\u0287\u003Eg.\ufffd|\ufffdF\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffde\\r\u071d\ufffd\ufffd\ufffd\ufffd\ufffd \\u0004^\ufffd\ufffdzE\ufffd#a\ufffd\ufffdyi3N\ufffd\u01e4*\\u0010 6t\ufffd\ufffd\\u0013\ufffdA^:\\u001d_\/EH\ufffdJW#\\u001fQ\ufffd;\u0287\u003Eg.\ufffd|\ufffdF\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffde\\r\u071d\ufffd\ufffd\ufffd\ufffd\ufffd \\u0004^\ufffd\ufffdzE\ufffd#a\ufffd\ufffdyi3N\ufffd\u01e4*\\u0010 6t\ufffd\ufffd\\u0013\ufffdA^:\\u001d_\/EH\ufffdJW#\\u001fQ\ufffd;\u0287\u003Eg.\ufffd|\ufffdF\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffde\\r\u071d\ufffd\ufffd\ufffd\ufffd\ufffd \\u0004^\ufffd\ufffdzE\ufffd#a\ufffd\ufffdyi3N\ufffd\u01e4*\\u0010 6t\ufffd\ufffd\\u0013\ufffdA^:\\u001d_\/EH\ufffdJW#\\u001fQ\ufffd;\u0287\u003Eg.\ufffd|\ufffdF\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022754f26965d413cd414fb52595ccdd59720824241\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffde\\r\u071d\ufffd\ufffd\ufffd\ufffd\ufffd \\u0004^\ufffd\ufffdzE\ufffd#a\ufffd\ufffdyi3N\ufffd\u01e4*\\u0010 6t\ufffd\ufffd\\u0013\ufffdA^:\\u001d_\/EH\ufffdJW#\\u001fQ\ufffd;\u0287\u003Eg.\ufffd|\ufffdF\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffde\\r\u071d\ufffd\ufffd\ufffd\ufffd\ufffd ^\ufffd\ufffdzE\ufffd#a\ufffd\ufffdyi3N\ufffd\u01e4* 6t\ufffd\ufffd\ufffdA^:_\/EH\ufffdJW#Q\ufffd;\u0287\u003Eg.\ufffd|\ufffdF\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffde\\r\u071d\ufffd\ufffd\ufffd\ufffd\ufffd \\u0004^\ufffd\ufffdzE\ufffd#a\ufffd\ufffdyi3N\ufffd\u01e4*\\u0010 6t\ufffd\ufffd\\u0013\ufffdA^:\\u001d_\/EH\ufffdJW#\\u001fQ\ufffd;\u0287\u003Eg.\ufffd|\ufffdF\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffde\\r\u071d\ufffd\ufffd\ufffd\ufffd\ufffd ^\ufffd\ufffdzE\ufffd#a\ufffd\ufffdyi3N\ufffd\u01e4* 6t\ufffd\ufffd\ufffdA^:_\/EH\ufffdJW#Q\ufffd;\u0287\u003Eg.\ufffd|\ufffdF\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031868,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":27169,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.81614284230672, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022884e3ee466e816542a2c54a72302e79c\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0004\ufffdB\ufffdn\ufffd3C\ufffd\ufffdx\ufffd\\u0001\\u0019\ufffd\ufffd\\u001d\ufffdD\\u001a\ufffd\ufffd\ufffd4\\u001c\\u0011y\ufffd\ufffd:\ufffd \ufffdri\ufffd\ufffd\ufffd\\u000b\ufffd3bJlr\\u000e`\ufffdB\ufffd+\\u001e9.\\u00009A8yW\ufffd}Q\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0004\ufffdB\ufffdn\ufffd3C\ufffd\ufffdx\ufffd\\u0001\\u0019\ufffd\ufffd\\u001d\ufffdD\\u001a\ufffd\ufffd\ufffd4\\u001c\\u0011y\ufffd\ufffd:\ufffd \ufffdri\ufffd\ufffd\ufffd\\u000b\ufffd3bJlr\\u000e`\ufffdB\ufffd+\\u001e9.\\u00009A8yW\ufffd}Q\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0004\ufffdB\ufffdn\ufffd3C\ufffd\ufffdx\ufffd\\u0001\\u0019\ufffd\ufffd\\u001d\ufffdD\\u001a\ufffd\ufffd\ufffd4\\u001c\\u0011y\ufffd\ufffd:\ufffd \ufffdri\ufffd\ufffd\ufffd\\u000b\ufffd3bJlr\\u000e`\ufffdB\ufffd+\\u001e9.\\u00009A8yW\ufffd}Q\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002219e84b90f49476f8070f16fad25190918945302a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0004\ufffdB\ufffdn\ufffd3C\ufffd\ufffdx\ufffd\\u0001\\u0019\ufffd\ufffd\\u001d\ufffdD\\u001a\ufffd\ufffd\ufffd4\\u001c\\u0011y\ufffd\ufffd:\ufffd \ufffdri\ufffd\ufffd\ufffd\\u000b\ufffd3bJlr\\u000e`\ufffdB\ufffd+\\u001e9.\\u00009A8yW\ufffd}Q\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdB\ufffdn\ufffd3C\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd4y\ufffd\ufffd:\ufffd \ufffdri\ufffd\ufffd\ufffd\ufffd3bJlr`\ufffdB\ufffd+9.9A8yW\ufffd}Q\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0004\ufffdB\ufffdn\ufffd3C\ufffd\ufffdx\ufffd\\u0001\\u0019\ufffd\ufffd\\u001d\ufffdD\\u001a\ufffd\ufffd\ufffd4\\u001c\\u0011y\ufffd\ufffd:\ufffd \ufffdri\ufffd\ufffd\ufffd\\u000b\ufffd3bJlr\\u000e`\ufffdB\ufffd+\\u001e9.\\u00009A8yW\ufffd}Q\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdB\ufffdn\ufffd3C\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd4y\ufffd\ufffd:\ufffd \ufffdri\ufffd\ufffd\ufffd\ufffd3bJlr`\ufffdB\ufffd+9.9A8yW\ufffd}Q\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031869,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":23887,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.824989980533248, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022905cfbcdaf7806835285e91954365a35\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\\\\ufffd^kw2m\ufffd\ufffdU\ufffd\ufffd\ufffd=\ufffd\u05ef\ufffd\ufffdY\ufffdg\ufffd\ufffd\\u0000=Z\ufffdmU \ufffds\ufffd\ufffd{\ufffd\\u0004\ufffd\ufffd\\u0017a\ufffd\\u0001\ufffd\ufffd\ufffd\\u001b\ufffd4\ufffd\\u0015p\ufffd)\ufffd\\\\c\ufffd\ufffd\\u0003\ufffdn\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\\\\ufffd^kw2m\ufffd\ufffdU\ufffd\ufffd\ufffd=\ufffd\u05ef\ufffd\ufffdY\ufffdg\ufffd\ufffd\\u0000=Z\ufffdmU \ufffds\ufffd\ufffd{\ufffd\\u0004\ufffd\ufffd\\u0017a\ufffd\\u0001\ufffd\ufffd\ufffd\\u001b\ufffd4\ufffd\\u0015p\ufffd)\ufffd\\\\c\ufffd\ufffd\\u0003\ufffdn\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\\\\ufffd^kw2m\ufffd\ufffdU\ufffd\ufffd\ufffd=\ufffd\u05ef\ufffd\ufffdY\ufffdg\ufffd\ufffd\\u0000=Z\ufffdmU \ufffds\ufffd\ufffd{\ufffd\\u0004\ufffd\ufffd\\u0017a\ufffd\\u0001\ufffd\ufffd\ufffd\\u001b\ufffd4\ufffd\\u0015p\ufffd)\ufffd\\\\c\ufffd\ufffd\\u0003\ufffdn\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221f4da7aa47dc1ff64474614916e11b26560d9e48\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\\\\ufffd^kw2m\ufffd\ufffdU\ufffd\ufffd\ufffd=\ufffd\u05ef\ufffd\ufffdY\ufffdg\ufffd\ufffd\\u0000=Z\ufffdmU \ufffds\ufffd\ufffd{\ufffd\\u0004\ufffd\ufffd\\u0017a\ufffd\\u0001\ufffd\ufffd\ufffd\\u001b\ufffd4\ufffd\\u0015p\ufffd)\ufffd\\\\c\ufffd\ufffd\\u0003\ufffdn\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\\\\\ufffd^kw2m\ufffd\ufffdU\ufffd\ufffd\ufffd=\ufffd\u05ef\ufffd\ufffdY\ufffdg\ufffd\ufffd=Z\ufffdmU \ufffds\ufffd\ufffd{\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffdp\ufffd)\ufffd\\\\c\ufffd\ufffd\ufffdn\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\\\\ufffd^kw2m\ufffd\ufffdU\ufffd\ufffd\ufffd=\ufffd\u05ef\ufffd\ufffdY\ufffdg\ufffd\ufffd\\u0000=Z\ufffdmU \ufffds\ufffd\ufffd{\ufffd\\u0004\ufffd\ufffd\\u0017a\ufffd\\u0001\ufffd\ufffd\ufffd\\u001b\ufffd4\ufffd\\u0015p\ufffd)\ufffd\\\\c\ufffd\ufffd\\u0003\ufffdn\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\\\\\ufffd^kw2m\ufffd\ufffdU\ufffd\ufffd\ufffd=\ufffd\u05ef\ufffd\ufffdY\ufffdg\ufffd\ufffd=Z\ufffdmU \ufffds\ufffd\ufffd{\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffdp\ufffd)\ufffd\\\\c\ufffd\ufffd\ufffdn\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031870,"ip":"207.154.210.146","ts":"2026-07-27 20:41:02.000000","proto":"tcp","src_port":17047,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.8223330849936135, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dcbd4ddea5750cd34cc85f5c463a3758\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u000f\ufffd5\ufffd\\u0016\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\\t\\u0007gsuk\ufffd\u0682\\u001a }\ufffd\u0026\\u0013p#\ufffdH\ufffd\ufffd\\u0000\ufffd|\ufffd5\ufffd.\ufffd\ufffd\\\u0022\u0188\ufffd\\u0015\\u0015\\u000e\\f\\u0000\ufffd\\tJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u000f\ufffd5\ufffd\\u0016\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\\t\\u0007gsuk\ufffd\u0682\\u001a }\ufffd\u0026\\u0013p#\ufffdH\ufffd\ufffd\\u0000\ufffd|\ufffd5\ufffd.\ufffd\ufffd\\\u0022\u0188\ufffd\\u0015\\u0015\\u000e\\f\\u0000\ufffd\\tJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u000f\ufffd5\ufffd\\u0016\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\\t\\u0007gsuk\ufffd\u0682\\u001a }\ufffd\u0026\\u0013p#\ufffdH\ufffd\ufffd\\u0000\ufffd|\ufffd5\ufffd.\ufffd\ufffd\\\u0022\u0188\ufffd\\u0015\\u0015\\u000e\\f\\u0000\ufffd\\tJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b49d32a94dadce3e9565a193cb839eb80db00b58\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u000f\ufffd5\ufffd\\u0016\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\\t\\u0007gsuk\ufffd\u0682\\u001a }\ufffd\u0026\\u0013p#\ufffdH\ufffd\ufffd\\u0000\ufffd|\ufffd5\ufffd.\ufffd\ufffd\\\u0022\u0188\ufffd\\u0015\\u0015\\u000e\\f\\u0000\ufffd\\tJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\\tgsuk\ufffd\u0682 }\ufffd\u0026p#\ufffdH\ufffd\ufffd\ufffd|\ufffd5\ufffd.\ufffd\ufffd\\\u0022\u0188\ufffd\ufffd\\tJ\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u000f\ufffd5\ufffd\\u0016\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\\t\\u0007gsuk\ufffd\u0682\\u001a }\ufffd\u0026\\u0013p#\ufffdH\ufffd\ufffd\\u0000\ufffd|\ufffd5\ufffd.\ufffd\ufffd\\\u0022\u0188\ufffd\\u0015\\u0015\\u000e\\f\\u0000\ufffd\\tJ\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd]6\ufffd\ufffd\ufffdsg\ufffdh\ufffdN\\tgsuk\ufffd\u0682 }\ufffd\u0026p#\ufffdH\ufffd\ufffd\ufffd|\ufffd5\ufffd.\ufffd\ufffd\\\u0022\u0188\ufffd\ufffd\\tJ\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031838,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":28755,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.820511645235458, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f1d6dd3dbd5214be49a996b01b012a02\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd,x\ufffd\ufffd\ufffd4r\ufffdo\ufffd\ufffd\\u000e=5R\ufffd\/\ufffd\ufffd5\ufffdt\\u001b\ufffd_\ufffd\ufffdF \ufffd#\ufffd\ufffd\ufffd\\r\/\ufffd( \\u001bS\ufffd\ufffdN \ufffd\\u0014J\ufffdw\ufffd\ufffd\u06b1\\u0005\u5e80\ufffd9\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd,x\ufffd\ufffd\ufffd4r\ufffdo\ufffd\ufffd\\u000e=5R\ufffd\/\ufffd\ufffd5\ufffdt\\u001b\ufffd_\ufffd\ufffdF \ufffd#\ufffd\ufffd\ufffd\\r\/\ufffd( \\u001bS\ufffd\ufffdN \ufffd\\u0014J\ufffdw\ufffd\ufffd\u06b1\\u0005\u5e80\ufffd9\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd,x\ufffd\ufffd\ufffd4r\ufffdo\ufffd\ufffd\\u000e=5R\ufffd\/\ufffd\ufffd5\ufffdt\\u001b\ufffd_\ufffd\ufffdF \ufffd#\ufffd\ufffd\ufffd\\r\/\ufffd( \\u001bS\ufffd\ufffdN \ufffd\\u0014J\ufffdw\ufffd\ufffd\u06b1\\u0005\u5e80\ufffd9\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd,x\ufffd\ufffd\ufffd4r\ufffdo\ufffd\ufffd\\u000e=5R\ufffd\/\ufffd\ufffd5\ufffdt\\u001b\ufffd_\ufffd\ufffdF \ufffd#\ufffd\ufffd\ufffd\\r\/\ufffd( \\u001bS\ufffd\ufffdN \ufffd\\u0014J\ufffdw\ufffd\ufffd\u06b1\\u0005\u5e80\ufffd9\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd,x\ufffd\ufffd\ufffd4r\ufffdo\ufffd\ufffd\\u000e=5R\ufffd\/\ufffd\ufffd5\ufffdt\\u001b\ufffd_\ufffd\ufffdF \ufffd#\ufffd\ufffd\ufffd\\r\/\ufffd( \\u001bS\ufffd\ufffdN \ufffd\\u0014J\ufffdw\ufffd\ufffd\u06b1\\u0005\u5e80\ufffd9\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022640590dc43b1b49ca1da5b5c979f827bddd73343\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd,x\ufffd\ufffd\ufffd4r\ufffdo\ufffd\ufffd\\u000e=5R\ufffd\/\ufffd\ufffd5\ufffdt\\u001b\ufffd_\ufffd\ufffdF \ufffd#\ufffd\ufffd\ufffd\\r\/\ufffd( \\u001bS\ufffd\ufffdN \ufffd\\u0014J\ufffdw\ufffd\ufffd\u06b1\\u0005\u5e80\ufffd9\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd,x\ufffd\ufffd\ufffd4r\ufffdo\ufffd\ufffd=5R\ufffd\/\ufffd\ufffd5\ufffdt\ufffd_\ufffd\ufffdF \ufffd#\ufffd\ufffd\ufffd\\r\/\ufffd( S\ufffd\ufffdN \ufffdJ\ufffdw\ufffd\ufffd\u06b1\u5e80\ufffd9\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd,x\ufffd\ufffd\ufffd4r\ufffdo\ufffd\ufffd\\u000e=5R\ufffd\/\ufffd\ufffd5\ufffdt\\u001b\ufffd_\ufffd\ufffdF \ufffd#\ufffd\ufffd\ufffd\\r\/\ufffd( \\u001bS\ufffd\ufffdN \ufffd\\u0014J\ufffdw\ufffd\ufffd\u06b1\\u0005\u5e80\ufffd9\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd,x\ufffd\ufffd\ufffd4r\ufffdo\ufffd\ufffd=5R\ufffd\/\ufffd\ufffd5\ufffdt\ufffd_\ufffd\ufffdF \ufffd#\ufffd\ufffd\ufffd\\r\/\ufffd( S\ufffd\ufffdN \ufffdJ\ufffdw\ufffd\ufffd\u06b1\u5e80\ufffd9\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031839,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":6529,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.852742413504654, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224495c41ef45b2571e9bcc967ff4ff044\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003GN|\ufffd\u05c3\ufffdP\ufffd\ufffd\\u000f\ufffd2\\u0019\ufffd7-\\fz!\ufffd+\ufffd\u003E\ufffd\\u000fD\\u0014\ufffd\ufffd lU~jQ\u0026\ufffdnZ\ufffd\\u001a\\u001e\ufffd\ufffd\ufffd\ufffdL\ufffd\\u0012\ufffd\\rv\ufffd=5\ufffd\\n\ufffd\ufffd\ufffdH{\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003GN|\ufffd\u05c3\ufffdP\ufffd\ufffd\\u000f\ufffd2\\u0019\ufffd7-\\fz!\ufffd+\ufffd\u003E\ufffd\\u000fD\\u0014\ufffd\ufffd lU~jQ\u0026\ufffdnZ\ufffd\\u001a\\u001e\ufffd\ufffd\ufffd\ufffdL\ufffd\\u0012\ufffd\\rv\ufffd=5\ufffd\\n\ufffd\ufffd\ufffdH{\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003GN|\ufffd\u05c3\ufffdP\ufffd\ufffd\\u000f\ufffd2\\u0019\ufffd7-\\fz!\ufffd+\ufffd\u003E\ufffd\\u000fD\\u0014\ufffd\ufffd lU~jQ\u0026\ufffdnZ\ufffd\\u001a\\u001e\ufffd\ufffd\ufffd\ufffdL\ufffd\\u0012\ufffd\\rv\ufffd=5\ufffd\\n\ufffd\ufffd\ufffdH{\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229e1bc97dd3851c6d5d18660a48c430c97d664fe8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003GN|\ufffd\u05c3\ufffdP\ufffd\ufffd\\u000f\ufffd2\\u0019\ufffd7-\\fz!\ufffd+\ufffd\u003E\ufffd\\u000fD\\u0014\ufffd\ufffd lU~jQ\u0026\ufffdnZ\ufffd\\u001a\\u001e\ufffd\ufffd\ufffd\ufffdL\ufffd\\u0012\ufffd\\rv\ufffd=5\ufffd\\n\ufffd\ufffd\ufffdH{\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdGN|\ufffd\u05c3\ufffdP\ufffd\ufffd\ufffd2\ufffd7-z!\ufffd+\ufffd\u003E\ufffdD\ufffd\ufffd lU~jQ\u0026\ufffdnZ\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd\ufffd\\rv\ufffd=5\ufffd\\n\ufffd\ufffd\ufffdH{\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003GN|\ufffd\u05c3\ufffdP\ufffd\ufffd\\u000f\ufffd2\\u0019\ufffd7-\\fz!\ufffd+\ufffd\u003E\ufffd\\u000fD\\u0014\ufffd\ufffd lU~jQ\u0026\ufffdnZ\ufffd\\u001a\\u001e\ufffd\ufffd\ufffd\ufffdL\ufffd\\u0012\ufffd\\rv\ufffd=5\ufffd\\n\ufffd\ufffd\ufffdH{\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdGN|\ufffd\u05c3\ufffdP\ufffd\ufffd\ufffd2\ufffd7-z!\ufffd+\ufffd\u003E\ufffdD\ufffd\ufffd lU~jQ\u0026\ufffdnZ\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd\ufffd\\rv\ufffd=5\ufffd\\n\ufffd\ufffd\ufffdH{\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031840,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":31423,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.849953032616663, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a8c3fbc08f1d24dd318bf0b15719b6f3\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffd~P\\u001f\\u0018\u066b\ufffd\\u001e\ufffdh(9f\ufffd\u02c6\ufffd\ufffd~=h\ufffd%LI\ufffd\\u0015\ufffd\ufffd \u003E\ufffd\ufffdg\ufffd_}\ufffd\ufffd\ufffdk\ufffd=\ufffd\\u0003\ufffd\\u000f\ufffdWLv\\u0013\ufffd3\ufffd\ufffd\ufffdi\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffd~P\\u001f\\u0018\u066b\ufffd\\u001e\ufffdh(9f\ufffd\u02c6\ufffd\ufffd~=h\ufffd%LI\ufffd\\u0015\ufffd\ufffd \u003E\ufffd\ufffdg\ufffd_}\ufffd\ufffd\ufffdk\ufffd=\ufffd\\u0003\ufffd\\u000f\ufffdWLv\\u0013\ufffd3\ufffd\ufffd\ufffdi\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffd~P\\u001f\\u0018\u066b\ufffd\\u001e\ufffdh(9f\ufffd\u02c6\ufffd\ufffd~=h\ufffd%LI\ufffd\\u0015\ufffd\ufffd \u003E\ufffd\ufffdg\ufffd_}\ufffd\ufffd\ufffdk\ufffd=\ufffd\\u0003\ufffd\\u000f\ufffdWLv\\u0013\ufffd3\ufffd\ufffd\ufffdi\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b717b44bc699963a047273f6f7211a1581798626\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffd~P\\u001f\\u0018\u066b\ufffd\\u001e\ufffdh(9f\ufffd\u02c6\ufffd\ufffd~=h\ufffd%LI\ufffd\\u0015\ufffd\ufffd \u003E\ufffd\ufffdg\ufffd_}\ufffd\ufffd\ufffdk\ufffd=\ufffd\\u0003\ufffd\\u000f\ufffdWLv\\u0013\ufffd3\ufffd\ufffd\ufffdi\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdL\ufffd~P\u066b\ufffd\ufffdh(9f\ufffd\u02c6\ufffd\ufffd~=h\ufffd%LI\ufffd\ufffd\ufffd \u003E\ufffd\ufffdg\ufffd_}\ufffd\ufffd\ufffdk\ufffd=\ufffd\ufffd\ufffdWLv\ufffd3\ufffd\ufffd\ufffdi\ufffdd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffd~P\\u001f\\u0018\u066b\ufffd\\u001e\ufffdh(9f\ufffd\u02c6\ufffd\ufffd~=h\ufffd%LI\ufffd\\u0015\ufffd\ufffd \u003E\ufffd\ufffdg\ufffd_}\ufffd\ufffd\ufffdk\ufffd=\ufffd\\u0003\ufffd\\u000f\ufffdWLv\\u0013\ufffd3\ufffd\ufffd\ufffdi\ufffdd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdL\ufffd~P\u066b\ufffd\ufffdh(9f\ufffd\u02c6\ufffd\ufffd~=h\ufffd%LI\ufffd\ufffd\ufffd \u003E\ufffd\ufffdg\ufffd_}\ufffd\ufffd\ufffdk\ufffd=\ufffd\ufffd\ufffdWLv\ufffd3\ufffd\ufffd\ufffdi\ufffdd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031841,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":32881,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.865896217938316, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226ebc87f91c95ac285070f7a5c5bf14c6\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017K)\ufffd\\u0003\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdxL\ufffdu)\ufffdV\ufffdluD\ufffd\ufffdV\ufffd?x\ufffd ~\ufffd3^\\u0002s\\u0011\ufffdwU:\ufffd\ufffd:\ufffd\ufffdu\\u000bG\ufffd\ufffd8Y\ufffd\ufffd\ufffd\\u0013n}\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017K)\ufffd\\u0003\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdxL\ufffdu)\ufffdV\ufffdluD\ufffd\ufffdV\ufffd?x\ufffd ~\ufffd3^\\u0002s\\u0011\ufffdwU:\ufffd\ufffd:\ufffd\ufffdu\\u000bG\ufffd\ufffd8Y\ufffd\ufffd\ufffd\\u0013n}\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017K)\ufffd\\u0003\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdxL\ufffdu)\ufffdV\ufffdluD\ufffd\ufffdV\ufffd?x\ufffd ~\ufffd3^\\u0002s\\u0011\ufffdwU:\ufffd\ufffd:\ufffd\ufffdu\\u000bG\ufffd\ufffd8Y\ufffd\ufffd\ufffd\\u0013n}\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f18115461d976fa5ec7a7afd0140404f2b2b243f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017K)\ufffd\\u0003\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdxL\ufffdu)\ufffdV\ufffdluD\ufffd\ufffdV\ufffd?x\ufffd ~\ufffd3^\\u0002s\\u0011\ufffdwU:\ufffd\ufffd:\ufffd\ufffdu\\u000bG\ufffd\ufffd8Y\ufffd\ufffd\ufffd\\u0013n}\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdK)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdxL\ufffdu)\ufffdV\ufffdluD\ufffd\ufffdV\ufffd?x\ufffd ~\ufffd3^s\ufffdwU:\ufffd\ufffd:\ufffd\ufffduG\ufffd\ufffd8Y\ufffd\ufffd\ufffdn}\ufffd\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017K)\ufffd\\u0003\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdxL\ufffdu)\ufffdV\ufffdluD\ufffd\ufffdV\ufffd?x\ufffd ~\ufffd3^\\u0002s\\u0011\ufffdwU:\ufffd\ufffd:\ufffd\ufffdu\\u000bG\ufffd\ufffd8Y\ufffd\ufffd\ufffd\\u0013n}\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdK)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdxL\ufffdu)\ufffdV\ufffdluD\ufffd\ufffdV\ufffd?x\ufffd ~\ufffd3^s\ufffdwU:\ufffd\ufffd:\ufffd\ufffduG\ufffd\ufffd8Y\ufffd\ufffd\ufffdn}\ufffd\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031843,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":5635,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.8498453650495055, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022270a41ad0cd29bdc8e8fa4d9a57da57a\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdo*\\\\\ufffd\ufffdtm\ufffdLLe\ufffd~\\u0018`\u0026\\u0001^\ufffd\ufffdi\ufffdy\ufffd\\u001f \ufffdR\\u0019\ufffd3 Y\ufffd\ufffd\ufffdZ\ufffd\\u0017WK\ufffd`D\\f\ufffd\\r\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd\\u0016}m\ufffd\ufffd\\u0016Ey\ufffd6\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdo*\\\\\ufffd\ufffdtm\ufffdLLe\ufffd~\\u0018`\u0026\\u0001^\ufffd\ufffdi\ufffdy\ufffd\\u001f \ufffdR\\u0019\ufffd3 Y\ufffd\ufffd\ufffdZ\ufffd\\u0017WK\ufffd`D\\f\ufffd\\r\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd\\u0016}m\ufffd\ufffd\\u0016Ey\ufffd6\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdo*\\\\\ufffd\ufffdtm\ufffdLLe\ufffd~\\u0018`\u0026\\u0001^\ufffd\ufffdi\ufffdy\ufffd\\u001f \ufffdR\\u0019\ufffd3 Y\ufffd\ufffd\ufffdZ\ufffd\\u0017WK\ufffd`D\\f\ufffd\\r\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd\\u0016}m\ufffd\ufffd\\u0016Ey\ufffd6\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229fbe80faeaa0417153fedcce55c785c6243eeeae\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdo*\\\\\ufffd\ufffdtm\ufffdLLe\ufffd~\\u0018`\u0026\\u0001^\ufffd\ufffdi\ufffdy\ufffd\\u001f \ufffdR\\u0019\ufffd3 Y\ufffd\ufffd\ufffdZ\ufffd\\u0017WK\ufffd`D\\f\ufffd\\r\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd\\u0016}m\ufffd\ufffd\\u0016Ey\ufffd6\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdo*\\\\\ufffd\ufffdtm\ufffdLLe\ufffd~`\u0026^\ufffd\ufffdi\ufffdy\ufffd \ufffdR\ufffd3 Y\ufffd\ufffd\ufffdZ\ufffdWK\ufffd`D\ufffd\\r\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd}m\ufffd\ufffdEy\ufffd6\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdo*\\\\\ufffd\ufffdtm\ufffdLLe\ufffd~\\u0018`\u0026\\u0001^\ufffd\ufffdi\ufffdy\ufffd\\u001f \ufffdR\\u0019\ufffd3 Y\ufffd\ufffd\ufffdZ\ufffd\\u0017WK\ufffd`D\\f\ufffd\\r\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd\\u0016}m\ufffd\ufffd\\u0016Ey\ufffd6\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdo*\\\\\ufffd\ufffdtm\ufffdLLe\ufffd~`\u0026^\ufffd\ufffdi\ufffdy\ufffd \ufffdR\ufffd3 Y\ufffd\ufffd\ufffdZ\ufffdWK\ufffd`D\ufffd\\r\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd}m\ufffd\ufffdEy\ufffd6\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031844,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":3363,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.855945040467012, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c580bee31d365b895d349d25f7ad6530\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdaPXJ\\u0012\ufffdkagC|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3\\u0005s\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\bp g$\u0027\\u0005\\r\ufffd7\ufffdK\u0688\ufffd\ufffd\\u0012?\ufffd\ufffdG\ufffd\u0262\ufffdQ\\u0018K\ufffdJ\ufffd\ufffd@\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdaPXJ\\u0012\ufffdkagC|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3\\u0005s\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\bp g$\u0027\\u0005\\r\ufffd7\ufffdK\u0688\ufffd\ufffd\\u0012?\ufffd\ufffdG\ufffd\u0262\ufffdQ\\u0018K\ufffdJ\ufffd\ufffd@\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdaPXJ\\u0012\ufffdkagC|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3\\u0005s\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\bp g$\u0027\\u0005\\r\ufffd7\ufffdK\u0688\ufffd\ufffd\\u0012?\ufffd\ufffdG\ufffd\u0262\ufffdQ\\u0018K\ufffdJ\ufffd\ufffd@\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d0113e0f9288bf4016631433c4229a0d3805e69c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdaPXJ\\u0012\ufffdkagC|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3\\u0005s\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\bp g$\u0027\\u0005\\r\ufffd7\ufffdK\u0688\ufffd\ufffd\\u0012?\ufffd\ufffdG\ufffd\u0262\ufffdQ\\u0018K\ufffdJ\ufffd\ufffd@\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdaPXJ\ufffdkagC|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3s\ufffd\ufffd\ufffd\ufffd\ufffdp g$\u0027\\r\ufffd7\ufffdK\u0688\ufffd\ufffd?\ufffd\ufffdG\ufffd\u0262\ufffdQK\ufffdJ\ufffd\ufffd@\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdaPXJ\\u0012\ufffdkagC|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3\\u0005s\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\bp g$\u0027\\u0005\\r\ufffd7\ufffdK\u0688\ufffd\ufffd\\u0012?\ufffd\ufffdG\ufffd\u0262\ufffdQ\\u0018K\ufffdJ\ufffd\ufffd@\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdaPXJ\ufffdkagC|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3s\ufffd\ufffd\ufffd\ufffd\ufffdp g$\u0027\\r\ufffd7\ufffdK\u0688\ufffd\ufffd?\ufffd\ufffdG\ufffd\u0262\ufffdQK\ufffdJ\ufffd\ufffd@\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031845,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":8873,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.822195201141437, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b02f069247e6f58f18543dbf3cdff6f3\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003|U\\u0017U\\u000bD.\ufffd\ufffd\ufffd\ufffdD\ufffdr\ufffd\\\\\ufffd\\r\ufffd\\u0000`k\ufffd-]\ufffd\ufffd\ufffd\ucc64\ufffd \ufffdK\ufffd(\\u0002\\\\_\u04a1aM\ufffd\ufffd\ufffd\\t\\u0017\ufffd\u02cc\ufffdN\ufffd\ufffd\\u000e\\u001a\\u001e\\\u0022\\rA\ufffdqs\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003|U\\u0017U\\u000bD.\ufffd\ufffd\ufffd\ufffdD\ufffdr\ufffd\\\\\ufffd\\r\ufffd\\u0000`k\ufffd-]\ufffd\ufffd\ufffd\ucc64\ufffd \ufffdK\ufffd(\\u0002\\\\_\u04a1aM\ufffd\ufffd\ufffd\\t\\u0017\ufffd\u02cc\ufffdN\ufffd\ufffd\\u000e\\u001a\\u001e\\\u0022\\rA\ufffdqs\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003|U\\u0017U\\u000bD.\ufffd\ufffd\ufffd\ufffdD\ufffdr\ufffd\\\\\ufffd\\r\ufffd\\u0000`k\ufffd-]\ufffd\ufffd\ufffd\ucc64\ufffd \ufffdK\ufffd(\\u0002\\\\_\u04a1aM\ufffd\ufffd\ufffd\\t\\u0017\ufffd\u02cc\ufffdN\ufffd\ufffd\\u000e\\u001a\\u001e\\\u0022\\rA\ufffdqs\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022067faa34122ff2aa2d7ea4908fb60169b1daac79\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003|U\\u0017U\\u000bD.\ufffd\ufffd\ufffd\ufffdD\ufffdr\ufffd\\\\\ufffd\\r\ufffd\\u0000`k\ufffd-]\ufffd\ufffd\ufffd\ucc64\ufffd \ufffdK\ufffd(\\u0002\\\\_\u04a1aM\ufffd\ufffd\ufffd\\t\\u0017\ufffd\u02cc\ufffdN\ufffd\ufffd\\u000e\\u001a\\u001e\\\u0022\\rA\ufffdqs\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd|UUD.\ufffd\ufffd\ufffd\ufffdD\ufffdr\ufffd\\\\\ufffd\\r\ufffd`k\ufffd-]\ufffd\ufffd\ufffd\ucc64\ufffd \ufffdK\ufffd(\\\\_\u04a1aM\ufffd\ufffd\ufffd\\t\ufffd\u02cc\ufffdN\ufffd\ufffd\\\u0022\\rA\ufffdqs\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003|U\\u0017U\\u000bD.\ufffd\ufffd\ufffd\ufffdD\ufffdr\ufffd\\\\\ufffd\\r\ufffd\\u0000`k\ufffd-]\ufffd\ufffd\ufffd\ucc64\ufffd \ufffdK\ufffd(\\u0002\\\\_\u04a1aM\ufffd\ufffd\ufffd\\t\\u0017\ufffd\u02cc\ufffdN\ufffd\ufffd\\u000e\\u001a\\u001e\\\u0022\\rA\ufffdqs\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd|UUD.\ufffd\ufffd\ufffd\ufffdD\ufffdr\ufffd\\\\\ufffd\\r\ufffd`k\ufffd-]\ufffd\ufffd\ufffd\ucc64\ufffd \ufffdK\ufffd(\\\\_\u04a1aM\ufffd\ufffd\ufffd\\t\ufffd\u02cc\ufffdN\ufffd\ufffd\\\u0022\\rA\ufffdqs\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031846,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":11387,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.86259057447703, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dbdde3f1de003e8ac79572870c67ebaa\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003j\ufffd\ufffdn\ufffd\ufffd~\ufffdX\ufffd]!xg\u0477\ufffd-\ufffd\ufffdY\ufffd\ufffdHl\ufffd\ufffdcBv_K \ufffdqb\ufffd\\u0006\ufffdc\ufffd\\u001eY\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd@\ufffdj\\u0010\\u0018\ufffdL\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffdL\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003j\ufffd\ufffdn\ufffd\ufffd~\ufffdX\ufffd]!xg\u0477\ufffd-\ufffd\ufffdY\ufffd\ufffdHl\ufffd\ufffdcBv_K \ufffdqb\ufffd\\u0006\ufffdc\ufffd\\u001eY\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd@\ufffdj\\u0010\\u0018\ufffdL\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffdL\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003j\ufffd\ufffdn\ufffd\ufffd~\ufffdX\ufffd]!xg\u0477\ufffd-\ufffd\ufffdY\ufffd\ufffdHl\ufffd\ufffdcBv_K \ufffdqb\ufffd\\u0006\ufffdc\ufffd\\u001eY\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd@\ufffdj\\u0010\\u0018\ufffdL\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffdL\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d3df6fa66ef9d4404edad70cb00d8d1e83d0c17e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003j\ufffd\ufffdn\ufffd\ufffd~\ufffdX\ufffd]!xg\u0477\ufffd-\ufffd\ufffdY\ufffd\ufffdHl\ufffd\ufffdcBv_K \ufffdqb\ufffd\\u0006\ufffdc\ufffd\\u001eY\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd@\ufffdj\\u0010\\u0018\ufffdL\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffdL\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdj\ufffd\ufffdn\ufffd\ufffd~\ufffdX\ufffd]!xg\u0477\ufffd-\ufffd\ufffdY\ufffd\ufffdHl\ufffd\ufffdcBv_K \ufffdqb\ufffd\ufffdc\ufffdY\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd@\ufffdj\ufffdL\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffdL\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003j\ufffd\ufffdn\ufffd\ufffd~\ufffdX\ufffd]!xg\u0477\ufffd-\ufffd\ufffdY\ufffd\ufffdHl\ufffd\ufffdcBv_K \ufffdqb\ufffd\\u0006\ufffdc\ufffd\\u001eY\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd@\ufffdj\\u0010\\u0018\ufffdL\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffdL\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdj\ufffd\ufffdn\ufffd\ufffd~\ufffdX\ufffd]!xg\u0477\ufffd-\ufffd\ufffdY\ufffd\ufffdHl\ufffd\ufffdcBv_K \ufffdqb\ufffd\ufffdc\ufffdY\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd@\ufffdj\ufffdL\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffdL\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031847,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":19875,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.804802212066922, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225a11105bb8d299b9077a2d3a409d4b25\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003*\ufffdx\ufffd\ufffd,\ufffd\\n\ufffdc\\u0013\ufffd\\u0007\ufffdLIeWa\ufffdu|Oe\\u0005\\btt\\u000f\ufffdl \ufffd\ufffdZ\\u001cz\\u0000\\u0007\ufffdn6\\u001d\ufffd\\u001d\ufffdc\ufffd\\u0011W\ufffdx0\\f\ufffd\ufffd(\\u0006\ufffd\ufffd(I\\n\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003*\ufffdx\ufffd\ufffd,\ufffd\\n\ufffdc\\u0013\ufffd\\u0007\ufffdLIeWa\ufffdu|Oe\\u0005\\btt\\u000f\ufffdl \ufffd\ufffdZ\\u001cz\\u0000\\u0007\ufffdn6\\u001d\ufffd\\u001d\ufffdc\ufffd\\u0011W\ufffdx0\\f\ufffd\ufffd(\\u0006\ufffd\ufffd(I\\n\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003*\ufffdx\ufffd\ufffd,\ufffd\\n\ufffdc\\u0013\ufffd\\u0007\ufffdLIeWa\ufffdu|Oe\\u0005\\btt\\u000f\ufffdl \ufffd\ufffdZ\\u001cz\\u0000\\u0007\ufffdn6\\u001d\ufffd\\u001d\ufffdc\ufffd\\u0011W\ufffdx0\\f\ufffd\ufffd(\\u0006\ufffd\ufffd(I\\n\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a953e6e54d97511c7e856fde42a1891b1af468fa\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003*\ufffdx\ufffd\ufffd,\ufffd\\n\ufffdc\\u0013\ufffd\\u0007\ufffdLIeWa\ufffdu|Oe\\u0005\\btt\\u000f\ufffdl \ufffd\ufffdZ\\u001cz\\u0000\\u0007\ufffdn6\\u001d\ufffd\\u001d\ufffdc\ufffd\\u0011W\ufffdx0\\f\ufffd\ufffd(\\u0006\ufffd\ufffd(I\\n\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd*\ufffdx\ufffd\ufffd,\ufffd\\n\ufffdc\ufffd\ufffdLIeWa\ufffdu|Oett\ufffdl \ufffd\ufffdZz\ufffdn6\ufffd\ufffdc\ufffdW\ufffdx0\ufffd\ufffd(\ufffd\ufffd(I\\n\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003*\ufffdx\ufffd\ufffd,\ufffd\\n\ufffdc\\u0013\ufffd\\u0007\ufffdLIeWa\ufffdu|Oe\\u0005\\btt\\u000f\ufffdl \ufffd\ufffdZ\\u001cz\\u0000\\u0007\ufffdn6\\u001d\ufffd\\u001d\ufffdc\ufffd\\u0011W\ufffdx0\\f\ufffd\ufffd(\\u0006\ufffd\ufffd(I\\n\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd*\ufffdx\ufffd\ufffd,\ufffd\\n\ufffdc\ufffd\ufffdLIeWa\ufffdu|Oett\ufffdl \ufffd\ufffdZz\ufffdn6\ufffd\ufffdc\ufffdW\ufffdx0\ufffd\ufffd(\ufffd\ufffd(I\\n\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031848,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":27829,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.868756421905025, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022504884584fbb48d55e5e81f1f3d80242\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffds\\r\ufffdfK8\\u0006;\ufffd0\ufffd\ufffd\\u0002\ufffd\ufffd\u003E\ufffdj\ufffd\\u0004\ufffdp\u05c6}O\ufffd\ufffd\\u001a\ufffd2 \ufffd\\b\ufffd\ufffd(\ufffd\ufffd\ufffd\\u0012\ufffd\ufffd\\u0018\ufffd\\b\ufffd\\u0015\ufffdJXP\\u000e\ufffddF\ufffd\ufffdM\ufffd4\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffds\\r\ufffdfK8\\u0006;\ufffd0\ufffd\ufffd\\u0002\ufffd\ufffd\u003E\ufffdj\ufffd\\u0004\ufffdp\u05c6}O\ufffd\ufffd\\u001a\ufffd2 \ufffd\\b\ufffd\ufffd(\ufffd\ufffd\ufffd\\u0012\ufffd\ufffd\\u0018\ufffd\\b\ufffd\\u0015\ufffdJXP\\u000e\ufffddF\ufffd\ufffdM\ufffd4\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffds\\r\ufffdfK8\\u0006;\ufffd0\ufffd\ufffd\\u0002\ufffd\ufffd\u003E\ufffdj\ufffd\\u0004\ufffdp\u05c6}O\ufffd\ufffd\\u001a\ufffd2 \ufffd\\b\ufffd\ufffd(\ufffd\ufffd\ufffd\\u0012\ufffd\ufffd\\u0018\ufffd\\b\ufffd\\u0015\ufffdJXP\\u000e\ufffddF\ufffd\ufffdM\ufffd4\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a9cd40c5daeba7adbb3271b2c273e11786e0d6b1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffds\\r\ufffdfK8\\u0006;\ufffd0\ufffd\ufffd\\u0002\ufffd\ufffd\u003E\ufffdj\ufffd\\u0004\ufffdp\u05c6}O\ufffd\ufffd\\u001a\ufffd2 \ufffd\\b\ufffd\ufffd(\ufffd\ufffd\ufffd\\u0012\ufffd\ufffd\\u0018\ufffd\\b\ufffd\\u0015\ufffdJXP\\u000e\ufffddF\ufffd\ufffdM\ufffd4\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffds\\r\ufffdfK8;\ufffd0\ufffd\ufffd\ufffd\ufffd\u003E\ufffdj\ufffd\ufffdp\u05c6}O\ufffd\ufffd\ufffd2 \ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJXP\ufffddF\ufffd\ufffdM\ufffd4\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffds\\r\ufffdfK8\\u0006;\ufffd0\ufffd\ufffd\\u0002\ufffd\ufffd\u003E\ufffdj\ufffd\\u0004\ufffdp\u05c6}O\ufffd\ufffd\\u001a\ufffd2 \ufffd\\b\ufffd\ufffd(\ufffd\ufffd\ufffd\\u0012\ufffd\ufffd\\u0018\ufffd\\b\ufffd\\u0015\ufffdJXP\\u000e\ufffddF\ufffd\ufffdM\ufffd4\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffds\\r\ufffdfK8;\ufffd0\ufffd\ufffd\ufffd\ufffd\u003E\ufffdj\ufffd\ufffdp\u05c6}O\ufffd\ufffd\ufffd2 \ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJXP\ufffddF\ufffd\ufffdM\ufffd4\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031849,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":30697,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.835330094932144, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f28590146f1ac57770c67eb82f4ac5db\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003s\ufffd\ufffd\\r\ufffd\\n\ufffd\ufffd\ufffd\\u0007Z\ufffd\ufffd@n,Y\\\\\\u0010\ufffdt\ufffd2\ufffd3\ufffd\ufffdU\\u0014\\u0007\ufffd\ufffd K\ufffd\ufffd~,\u02eb!\u0027\u37ad\\u000f\\u0012\ufffd=i\u003E\ufffd\ufffd\\u0012\ufffd\ufffd\\u0015\ufffdB!\ufffd\ufffdu\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003s\ufffd\ufffd\\r\ufffd\\n\ufffd\ufffd\ufffd\\u0007Z\ufffd\ufffd@n,Y\\\\\\u0010\ufffdt\ufffd2\ufffd3\ufffd\ufffdU\\u0014\\u0007\ufffd\ufffd K\ufffd\ufffd~,\u02eb!\u0027\u37ad\\u000f\\u0012\ufffd=i\u003E\ufffd\ufffd\\u0012\ufffd\ufffd\\u0015\ufffdB!\ufffd\ufffdu\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003s\ufffd\ufffd\\r\ufffd\\n\ufffd\ufffd\ufffd\\u0007Z\ufffd\ufffd@n,Y\\\\\\u0010\ufffdt\ufffd2\ufffd3\ufffd\ufffdU\\u0014\\u0007\ufffd\ufffd K\ufffd\ufffd~,\u02eb!\u0027\u37ad\\u000f\\u0012\ufffd=i\u003E\ufffd\ufffd\\u0012\ufffd\ufffd\\u0015\ufffdB!\ufffd\ufffdu\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f3288db8c144639c23b32b67f81f1f9123ca14a6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003s\ufffd\ufffd\\r\ufffd\\n\ufffd\ufffd\ufffd\\u0007Z\ufffd\ufffd@n,Y\\\\\\u0010\ufffdt\ufffd2\ufffd3\ufffd\ufffdU\\u0014\\u0007\ufffd\ufffd K\ufffd\ufffd~,\u02eb!\u0027\u37ad\\u000f\\u0012\ufffd=i\u003E\ufffd\ufffd\\u0012\ufffd\ufffd\\u0015\ufffdB!\ufffd\ufffdu\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffds\ufffd\ufffd\\r\ufffd\\n\ufffd\ufffd\ufffdZ\ufffd\ufffd@n,Y\\\\\ufffdt\ufffd2\ufffd3\ufffd\ufffdU\ufffd\ufffd K\ufffd\ufffd~,\u02eb!\u0027\u37ad\ufffd=i\u003E\ufffd\ufffd\ufffd\ufffd\ufffdB!\ufffd\ufffdu\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003s\ufffd\ufffd\\r\ufffd\\n\ufffd\ufffd\ufffd\\u0007Z\ufffd\ufffd@n,Y\\\\\\u0010\ufffdt\ufffd2\ufffd3\ufffd\ufffdU\\u0014\\u0007\ufffd\ufffd K\ufffd\ufffd~,\u02eb!\u0027\u37ad\\u000f\\u0012\ufffd=i\u003E\ufffd\ufffd\\u0012\ufffd\ufffd\\u0015\ufffdB!\ufffd\ufffdu\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffds\ufffd\ufffd\\r\ufffd\\n\ufffd\ufffd\ufffdZ\ufffd\ufffd@n,Y\\\\\ufffdt\ufffd2\ufffd3\ufffd\ufffdU\ufffd\ufffd K\ufffd\ufffd~,\u02eb!\u0027\u37ad\ufffd=i\u003E\ufffd\ufffd\ufffd\ufffd\ufffdB!\ufffd\ufffdu\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031850,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":8145,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.830928017647895, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a3e20ce8c9f03525aaab977e0dc576d0\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdu\\u0011\ufffd\ufffd\\u0017\ufffdV\ufffdv2\\n\ufffdqd\ufffd\ufffd)\\u00002\ufffdn\ufffd\\u0016\ufffd\ufffdX\ufffd\ufffdb\ufffd \\\\\ufffd\\r\ufffd\\u001fS5aMQ\ufffd~\ufffd\ufffd\ufffdMU*\\u00068\ufffd\ufffdJ\u0467\ufffd\ufffd\ufffd\ufffd8\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdu\\u0011\ufffd\ufffd\\u0017\ufffdV\ufffdv2\\n\ufffdqd\ufffd\ufffd)\\u00002\ufffdn\ufffd\\u0016\ufffd\ufffdX\ufffd\ufffdb\ufffd \\\\\ufffd\\r\ufffd\\u001fS5aMQ\ufffd~\ufffd\ufffd\ufffdMU*\\u00068\ufffd\ufffdJ\u0467\ufffd\ufffd\ufffd\ufffd8\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdu\\u0011\ufffd\ufffd\\u0017\ufffdV\ufffdv2\\n\ufffdqd\ufffd\ufffd)\\u00002\ufffdn\ufffd\\u0016\ufffd\ufffdX\ufffd\ufffdb\ufffd \\\\\ufffd\\r\ufffd\\u001fS5aMQ\ufffd~\ufffd\ufffd\ufffdMU*\\u00068\ufffd\ufffdJ\u0467\ufffd\ufffd\ufffd\ufffd8\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224d16d7e1d3d95594d0e84e8701dd2e47e8a2429a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdu\\u0011\ufffd\ufffd\\u0017\ufffdV\ufffdv2\\n\ufffdqd\ufffd\ufffd)\\u00002\ufffdn\ufffd\\u0016\ufffd\ufffdX\ufffd\ufffdb\ufffd \\\\\ufffd\\r\ufffd\\u001fS5aMQ\ufffd~\ufffd\ufffd\ufffdMU*\\u00068\ufffd\ufffdJ\u0467\ufffd\ufffd\ufffd\ufffd8\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdu\ufffd\ufffd\ufffdV\ufffdv2\\n\ufffdqd\ufffd\ufffd)2\ufffdn\ufffd\ufffd\ufffdX\ufffd\ufffdb\ufffd \\\\\ufffd\\r\ufffdS5aMQ\ufffd~\ufffd\ufffd\ufffdMU*8\ufffd\ufffdJ\u0467\ufffd\ufffd\ufffd\ufffd8\ufffdI\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdu\\u0011\ufffd\ufffd\\u0017\ufffdV\ufffdv2\\n\ufffdqd\ufffd\ufffd)\\u00002\ufffdn\ufffd\\u0016\ufffd\ufffdX\ufffd\ufffdb\ufffd \\\\\ufffd\\r\ufffd\\u001fS5aMQ\ufffd~\ufffd\ufffd\ufffdMU*\\u00068\ufffd\ufffdJ\u0467\ufffd\ufffd\ufffd\ufffd8\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdu\ufffd\ufffd\ufffdV\ufffdv2\\n\ufffdqd\ufffd\ufffd)2\ufffdn\ufffd\ufffd\ufffdX\ufffd\ufffdb\ufffd \\\\\ufffd\\r\ufffdS5aMQ\ufffd~\ufffd\ufffd\ufffdMU*8\ufffd\ufffdJ\u0467\ufffd\ufffd\ufffd\ufffd8\ufffdI\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031851,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":29179,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.845618898603629, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224ae5c3adc4d0c1295c564efbaef64ee2\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffds\\u001f\ufffd}5\u0471\ufffd\ufffd\ufffdpI$\\u0007\\u0005\ufffd\ufffdI\ufffd\ufffdP\u0241\\u001d\\u0001\\u0013\ufffdF\ufffd b\\\u0022\\u0019^*G\\r-#\u0163\ufffdE\ufffd\ufffd\ufffdb\ufffdP\ufffd\ufffd\ufffdv\ufffd\ufffd\\u001eNfm\ufffd\\u0016j\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffds\\u001f\ufffd}5\u0471\ufffd\ufffd\ufffdpI$\\u0007\\u0005\ufffd\ufffdI\ufffd\ufffdP\u0241\\u001d\\u0001\\u0013\ufffdF\ufffd b\\\u0022\\u0019^*G\\r-#\u0163\ufffdE\ufffd\ufffd\ufffdb\ufffdP\ufffd\ufffd\ufffdv\ufffd\ufffd\\u001eNfm\ufffd\\u0016j\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffds\\u001f\ufffd}5\u0471\ufffd\ufffd\ufffdpI$\\u0007\\u0005\ufffd\ufffdI\ufffd\ufffdP\u0241\\u001d\\u0001\\u0013\ufffdF\ufffd b\\\u0022\\u0019^*G\\r-#\u0163\ufffdE\ufffd\ufffd\ufffdb\ufffdP\ufffd\ufffd\ufffdv\ufffd\ufffd\\u001eNfm\ufffd\\u0016j\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022aaa81a6eb4ba8101fc7b361a31ee9418c48dea4e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffds\\u001f\ufffd}5\u0471\ufffd\ufffd\ufffdpI$\\u0007\\u0005\ufffd\ufffdI\ufffd\ufffdP\u0241\\u001d\\u0001\\u0013\ufffdF\ufffd b\\\u0022\\u0019^*G\\r-#\u0163\ufffdE\ufffd\ufffd\ufffdb\ufffdP\ufffd\ufffd\ufffdv\ufffd\ufffd\\u001eNfm\ufffd\\u0016j\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdL\ufffds\ufffd}5\u0471\ufffd\ufffd\ufffdpI$\ufffd\ufffdI\ufffd\ufffdP\u0241\ufffdF\ufffd b\\\u0022^*G\\r-#\u0163\ufffdE\ufffd\ufffd\ufffdb\ufffdP\ufffd\ufffd\ufffdv\ufffd\ufffdNfm\ufffdj\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdL\ufffds\\u001f\ufffd}5\u0471\ufffd\ufffd\ufffdpI$\\u0007\\u0005\ufffd\ufffdI\ufffd\ufffdP\u0241\\u001d\\u0001\\u0013\ufffdF\ufffd b\\\u0022\\u0019^*G\\r-#\u0163\ufffdE\ufffd\ufffd\ufffdb\ufffdP\ufffd\ufffd\ufffdv\ufffd\ufffd\\u001eNfm\ufffd\\u0016j\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdL\ufffds\ufffd}5\u0471\ufffd\ufffd\ufffdpI$\ufffd\ufffdI\ufffd\ufffdP\u0241\ufffdF\ufffd b\\\u0022^*G\\r-#\u0163\ufffdE\ufffd\ufffd\ufffdb\ufffdP\ufffd\ufffd\ufffdv\ufffd\ufffdNfm\ufffdj\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031852,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":31939,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.8420182742561515, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c7d0d45f7aa9bcc459df937c45067664\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd7\\u0014\ufffd\ufffdJT(#5\ufffd\ufffd\\u0007\ufffdt\ufffdp\ufffdB\ufffd\u0523\ufffd\ufffd wS\ufffd\ufffd\\u0001F\ufffdB\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdc\\t\u0387}J\\u0016\\u0019\ufffd\ufffdu\ufffd\ufffd@\ufffd2\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd7\\u0014\ufffd\ufffdJT(#5\ufffd\ufffd\\u0007\ufffdt\ufffdp\ufffdB\ufffd\u0523\ufffd\ufffd wS\ufffd\ufffd\\u0001F\ufffdB\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdc\\t\u0387}J\\u0016\\u0019\ufffd\ufffdu\ufffd\ufffd@\ufffd2\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd7\\u0014\ufffd\ufffdJT(#5\ufffd\ufffd\\u0007\ufffdt\ufffdp\ufffdB\ufffd\u0523\ufffd\ufffd wS\ufffd\ufffd\\u0001F\ufffdB\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdc\\t\u0387}J\\u0016\\u0019\ufffd\ufffdu\ufffd\ufffd@\ufffd2\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f4527f43f0df2f24bc2099c7fcb80a7b537bcef1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd7\\u0014\ufffd\ufffdJT(#5\ufffd\ufffd\\u0007\ufffdt\ufffdp\ufffdB\ufffd\u0523\ufffd\ufffd wS\ufffd\ufffd\\u0001F\ufffdB\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdc\\t\u0387}J\\u0016\\u0019\ufffd\ufffdu\ufffd\ufffd@\ufffd2\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdF\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffdJT(#5\ufffd\ufffd\ufffdt\ufffdp\ufffdB\ufffd\u0523\ufffd\ufffd wS\ufffd\ufffdF\ufffdB\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdc\\t\u0387}J\ufffd\ufffdu\ufffd\ufffd@\ufffd2\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd7\\u0014\ufffd\ufffdJT(#5\ufffd\ufffd\\u0007\ufffdt\ufffdp\ufffdB\ufffd\u0523\ufffd\ufffd wS\ufffd\ufffd\\u0001F\ufffdB\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdc\\t\u0387}J\\u0016\\u0019\ufffd\ufffdu\ufffd\ufffd@\ufffd2\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdF\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffdJT(#5\ufffd\ufffd\ufffdt\ufffdp\ufffdB\ufffd\u0523\ufffd\ufffd wS\ufffd\ufffdF\ufffdB\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffdc\\t\u0387}J\ufffd\ufffdu\ufffd\ufffd@\ufffd2\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031853,"ip":"207.154.210.146","ts":"2026-07-27 20:41:01.000000","proto":"tcp","src_port":6523,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.829002692141646, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fd2456bcd1f80ea8cffefb172da09e64\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd#Id\ufffd\ufffd\u01c8\ufffd?\ufffd\ufffdKn\ufffd\ufffd=U\ufffd(\ufffd\ufffd\ufffdc#\\u0004\\u0010\ufffd9\ufffd4\ufffd \ufffd+3\u8f03\\u000bX\/\\u0003\ufffd\ufffd\\u0018\ufffd\\\\HB\ufffd\\\u0022\\n`w\ufffd\\u0012\\u0001o\ufffd\\u0013\ufffd\u02b5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd#Id\ufffd\ufffd\u01c8\ufffd?\ufffd\ufffdKn\ufffd\ufffd=U\ufffd(\ufffd\ufffd\ufffdc#\\u0004\\u0010\ufffd9\ufffd4\ufffd \ufffd+3\u8f03\\u000bX\/\\u0003\ufffd\ufffd\\u0018\ufffd\\\\HB\ufffd\\\u0022\\n`w\ufffd\\u0012\\u0001o\ufffd\\u0013\ufffd\u02b5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd#Id\ufffd\ufffd\u01c8\ufffd?\ufffd\ufffdKn\ufffd\ufffd=U\ufffd(\ufffd\ufffd\ufffdc#\\u0004\\u0010\ufffd9\ufffd4\ufffd \ufffd+3\u8f03\\u000bX\/\\u0003\ufffd\ufffd\\u0018\ufffd\\\\HB\ufffd\\\u0022\\n`w\ufffd\\u0012\\u0001o\ufffd\\u0013\ufffd\u02b5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229de3d7ae9e7c59d1646e6aa29b73989aed7c6c23\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd#Id\ufffd\ufffd\u01c8\ufffd?\ufffd\ufffdKn\ufffd\ufffd=U\ufffd(\ufffd\ufffd\ufffdc#\\u0004\\u0010\ufffd9\ufffd4\ufffd \ufffd+3\u8f03\\u000bX\/\\u0003\ufffd\ufffd\\u0018\ufffd\\\\HB\ufffd\\\u0022\\n`w\ufffd\\u0012\\u0001o\ufffd\\u0013\ufffd\u02b5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd#Id\ufffd\ufffd\u01c8\ufffd?\ufffd\ufffdKn\ufffd\ufffd=U\ufffd(\ufffd\ufffd\ufffdc#\ufffd9\ufffd4\ufffd \ufffd+3\u8f03X\/\ufffd\ufffd\ufffd\\\\HB\ufffd\\\u0022\\n`w\ufffdo\ufffd\ufffd\u02b5\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd#Id\ufffd\ufffd\u01c8\ufffd?\ufffd\ufffdKn\ufffd\ufffd=U\ufffd(\ufffd\ufffd\ufffdc#\\u0004\\u0010\ufffd9\ufffd4\ufffd \ufffd+3\u8f03\\u000bX\/\\u0003\ufffd\ufffd\\u0018\ufffd\\\\HB\ufffd\\\u0022\\n`w\ufffd\\u0012\\u0001o\ufffd\\u0013\ufffd\u02b5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd#Id\ufffd\ufffd\u01c8\ufffd?\ufffd\ufffdKn\ufffd\ufffd=U\ufffd(\ufffd\ufffd\ufffdc#\ufffd9\ufffd4\ufffd \ufffd+3\u8f03X\/\ufffd\ufffd\ufffd\\\\HB\ufffd\\\u0022\\n`w\ufffdo\ufffd\ufffd\u02b5\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031820,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":26591,"dst_port":6443,"service":"k8s-api","classification":"dnp3_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.829366539795741, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022confidence\u0022: 0.51, \u0022classification_confidence\u0022: 0.51, \u0022precision_score\u0022: 60, \u0022precision_signals\u0022: [\u0022pat-0794\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0794\u0022], \u0022matched_patterns\u0022: [\u0022pat-0794\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Sigma DNP3 link\u0022, \u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0794\u0022, \u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 51.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224284d643e6fa151b42a39409b058956e\u0022, \u0022path_pattern_hash\u0022: \u0022859b07b9d78548343d57aca7faf5fc6a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdM%\ufffd\ufffd\ufffd\\u0001\ufffd\ufffd\\u0005\ufffdd\u003E\u0027\\u0005D\\u0001Q\ufffd\ufffd*\ufffd\\u0011T\ufffdte\ufffd\ufffd\\u0017$\ufffd \\u0012f\ufffdg\ufffd\u0212\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0005(\ufffdbQ\ufffd2l\ufffd\u01ed\ufffd\ufffd\\u001d\ufffdy\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdM%\ufffd\ufffd\ufffd\\u0001\ufffd\ufffd\\u0005\ufffdd\u003E\u0027\\u0005D\\u0001Q\ufffd\ufffd*\ufffd\\u0011T\ufffdte\ufffd\ufffd\\u0017$\ufffd \\u0012f\ufffdg\ufffd\u0212\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0005(\ufffdbQ\ufffd2l\ufffd\u01ed\ufffd\ufffd\\u001d\ufffdy\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdM%\ufffd\ufffd\ufffd\\u0001\ufffd\ufffd\\u0005\ufffdd\u003E\u0027\\u0005D\\u0001Q\ufffd\ufffd*\ufffd\\u0011T\ufffdte\ufffd\ufffd\\u0017$\ufffd \\u0012f\ufffdg\ufffd\u0212\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0005(\ufffdbQ\ufffd2l\ufffd\u01ed\ufffd\ufffd\\u001d\ufffdy\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022ics_probe\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002216f253bc15e6d874c81364f6dfd39981d56cc5b2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdM%\ufffd\ufffd\ufffd\\u0001\ufffd\ufffd\\u0005\ufffdd\u003E\u0027\\u0005D\\u0001Q\ufffd\ufffd*\ufffd\\u0011T\ufffdte\ufffd\ufffd\\u0017$\ufffd \\u0012f\ufffdg\ufffd\u0212\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0005(\ufffdbQ\ufffd2l\ufffd\u01ed\ufffd\ufffd\\u001d\ufffdy\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdM%\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd\u003E\u0027DQ\ufffd\ufffd*\ufffdT\ufffdte\ufffd\ufffd$\ufffd f\ufffdg\ufffd\u0212\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdbQ\ufffd2l\ufffd\u01ed\ufffd\ufffd\ufffdy\ufffdI\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022dnp3 probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 51, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0794\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0794\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdM%\ufffd\ufffd\ufffd\\u0001\ufffd\ufffd\\u0005\ufffdd\u003E\u0027\\u0005D\\u0001Q\ufffd\ufffd*\ufffd\\u0011T\ufffdte\ufffd\ufffd\\u0017$\ufffd \\u0012f\ufffdg\ufffd\u0212\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0005(\ufffdbQ\ufffd2l\ufffd\u01ed\ufffd\ufffd\\u001d\ufffdy\ufffdI\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022dnp3 probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdM%\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd\u003E\u0027DQ\ufffd\ufffd*\ufffdT\ufffdte\ufffd\ufffd$\ufffd f\ufffdg\ufffd\u0212\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdbQ\ufffd2l\ufffd\u01ed\ufffd\ufffd\ufffdy\ufffdI\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 51 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031821,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":31411,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.788056069801893, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223f566bbad1e4bee37a7b89c8d1b6e63b\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003K\\t\ufffd\ufffd-*\ufffd\u031a\ufffd}\ufffdx\ufffd\\u0018@\\u0019\ufffd\u02b4$uS\ufffd\\u0007} \ufffdq\ufffd\ufffd \ufffd\ufffd\\f,\ufffdO\\u001e\ufffd\ufffd\ufffdt\ufffdMo\ufffd\\u0002\ufffd\ufffd\\u000f\ufffd\ufffd\\f\\u0012a\ufffdC\ufffd\\u0000\ufffd\ufffd\ufffdt\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003K\\t\ufffd\ufffd-*\ufffd\u031a\ufffd}\ufffdx\ufffd\\u0018@\\u0019\ufffd\u02b4$uS\ufffd\\u0007} \ufffdq\ufffd\ufffd \ufffd\ufffd\\f,\ufffdO\\u001e\ufffd\ufffd\ufffdt\ufffdMo\ufffd\\u0002\ufffd\ufffd\\u000f\ufffd\ufffd\\f\\u0012a\ufffdC\ufffd\\u0000\ufffd\ufffd\ufffdt\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003K\\t\ufffd\ufffd-*\ufffd\u031a\ufffd}\ufffdx\ufffd\\u0018@\\u0019\ufffd\u02b4$uS\ufffd\\u0007} \ufffdq\ufffd\ufffd \ufffd\ufffd\\f,\ufffdO\\u001e\ufffd\ufffd\ufffdt\ufffdMo\ufffd\\u0002\ufffd\ufffd\\u000f\ufffd\ufffd\\f\\u0012a\ufffdC\ufffd\\u0000\ufffd\ufffd\ufffdt\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ac9f9ab01bcad5bb9c0af79f5216ae7e44a7a2e9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003K\\t\ufffd\ufffd-*\ufffd\u031a\ufffd}\ufffdx\ufffd\\u0018@\\u0019\ufffd\u02b4$uS\ufffd\\u0007} \ufffdq\ufffd\ufffd \ufffd\ufffd\\f,\ufffdO\\u001e\ufffd\ufffd\ufffdt\ufffdMo\ufffd\\u0002\ufffd\ufffd\\u000f\ufffd\ufffd\\f\\u0012a\ufffdC\ufffd\\u0000\ufffd\ufffd\ufffdt\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdK\\t\ufffd\ufffd-*\ufffd\u031a\ufffd}\ufffdx\ufffd@\ufffd\u02b4$uS\ufffd} \ufffdq\ufffd\ufffd \ufffd\ufffd,\ufffdO\ufffd\ufffd\ufffdt\ufffdMo\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdC\ufffd\ufffd\ufffd\ufffdt\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003K\\t\ufffd\ufffd-*\ufffd\u031a\ufffd}\ufffdx\ufffd\\u0018@\\u0019\ufffd\u02b4$uS\ufffd\\u0007} \ufffdq\ufffd\ufffd \ufffd\ufffd\\f,\ufffdO\\u001e\ufffd\ufffd\ufffdt\ufffdMo\ufffd\\u0002\ufffd\ufffd\\u000f\ufffd\ufffd\\f\\u0012a\ufffdC\ufffd\\u0000\ufffd\ufffd\ufffdt\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdK\\t\ufffd\ufffd-*\ufffd\u031a\ufffd}\ufffdx\ufffd@\ufffd\u02b4$uS\ufffd} \ufffdq\ufffd\ufffd \ufffd\ufffd,\ufffdO\ufffd\ufffd\ufffdt\ufffdMo\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdC\ufffd\ufffd\ufffd\ufffdt\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031823,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":5139,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.808980277393199, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002237db9f99a0ec3ab3e7696eb541ad44c9\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdQ\ufffd@\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\\u0003\ufffdu\ufffd:\ua659\ufffd\ufffdAd\ufffd\u01e5D\ufffd\ufffd \ufffd{\\u0017\\u0017L`\ufffd\\u0013I\ufffd\ufffd\ufffd\\u0002Z\ufffdL\ufffd.n\ufffd\ufffd\u0090\ufffd*\ufffdE\ufffdp\ufffd\\u0004\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdQ\ufffd@\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\\u0003\ufffdu\ufffd:\ua659\ufffd\ufffdAd\ufffd\u01e5D\ufffd\ufffd \ufffd{\\u0017\\u0017L`\ufffd\\u0013I\ufffd\ufffd\ufffd\\u0002Z\ufffdL\ufffd.n\ufffd\ufffd\u0090\ufffd*\ufffdE\ufffdp\ufffd\\u0004\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdQ\ufffd@\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\\u0003\ufffdu\ufffd:\ua659\ufffd\ufffdAd\ufffd\u01e5D\ufffd\ufffd \ufffd{\\u0017\\u0017L`\ufffd\\u0013I\ufffd\ufffd\ufffd\\u0002Z\ufffdL\ufffd.n\ufffd\ufffd\u0090\ufffd*\ufffdE\ufffdp\ufffd\\u0004\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224f531f997461f9f36e0f4b12273f7f7e41f9050b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdQ\ufffd@\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\\u0003\ufffdu\ufffd:\ua659\ufffd\ufffdAd\ufffd\u01e5D\ufffd\ufffd \ufffd{\\u0017\\u0017L`\ufffd\\u0013I\ufffd\ufffd\ufffd\\u0002Z\ufffdL\ufffd.n\ufffd\ufffd\u0090\ufffd*\ufffdE\ufffdp\ufffd\\u0004\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdQ\ufffd@\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffdu\ufffd:\ua659\ufffd\ufffdAd\ufffd\u01e5D\ufffd\ufffd \ufffd{L`\ufffdI\ufffd\ufffd\ufffdZ\ufffdL\ufffd.n\ufffd\ufffd\u0090\ufffd*\ufffdE\ufffdp\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdQ\ufffd@\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\\u0003\ufffdu\ufffd:\ua659\ufffd\ufffdAd\ufffd\u01e5D\ufffd\ufffd \ufffd{\\u0017\\u0017L`\ufffd\\u0013I\ufffd\ufffd\ufffd\\u0002Z\ufffdL\ufffd.n\ufffd\ufffd\u0090\ufffd*\ufffdE\ufffdp\ufffd\\u0004\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdQ\ufffd@\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffdu\ufffd:\ua659\ufffd\ufffdAd\ufffd\u01e5D\ufffd\ufffd \ufffd{L`\ufffdI\ufffd\ufffd\ufffdZ\ufffdL\ufffd.n\ufffd\ufffd\u0090\ufffd*\ufffdE\ufffdp\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031824,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":23873,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.851406418261885, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e88c47ea254fdb31926072f55b93783c\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0014\ufffdu\ufffd\ufffd\\u00187\ufffd\ufffd\ufffd\ufffdZ\ufffd\\t\\u0016\\u0010uk\ufffdp\ufffd\ufffdG\ufffd\ufffdP\ufffd .\\u001e\\u0013M\u3dc1;p\\u0007 |\\u0015nr\\u0000\\u0002\ufffd\\u00136t\ufffd\ufffd\ufffd\ufffd5b\ufffd\ufffd^\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0014\ufffdu\ufffd\ufffd\\u00187\ufffd\ufffd\ufffd\ufffdZ\ufffd\\t\\u0016\\u0010uk\ufffdp\ufffd\ufffdG\ufffd\ufffdP\ufffd .\\u001e\\u0013M\u3dc1;p\\u0007 |\\u0015nr\\u0000\\u0002\ufffd\\u00136t\ufffd\ufffd\ufffd\ufffd5b\ufffd\ufffd^\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0014\ufffdu\ufffd\ufffd\\u00187\ufffd\ufffd\ufffd\ufffdZ\ufffd\\t\\u0016\\u0010uk\ufffdp\ufffd\ufffdG\ufffd\ufffdP\ufffd .\\u001e\\u0013M\u3dc1;p\\u0007 |\\u0015nr\\u0000\\u0002\ufffd\\u00136t\ufffd\ufffd\ufffd\ufffd5b\ufffd\ufffd^\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002291d9eb40a15ae5bb13293205a08ef1a169af70c2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0014\ufffdu\ufffd\ufffd\\u00187\ufffd\ufffd\ufffd\ufffdZ\ufffd\\t\\u0016\\u0010uk\ufffdp\ufffd\ufffdG\ufffd\ufffdP\ufffd .\\u001e\\u0013M\u3dc1;p\\u0007 |\\u0015nr\\u0000\\u0002\ufffd\\u00136t\ufffd\ufffd\ufffd\ufffd5b\ufffd\ufffd^\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffdZ\ufffd\\tuk\ufffdp\ufffd\ufffdG\ufffd\ufffdP\ufffd .M\u3dc1;p |nr\ufffd6t\ufffd\ufffd\ufffd\ufffd5b\ufffd\ufffd^\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u0014\ufffdu\ufffd\ufffd\\u00187\ufffd\ufffd\ufffd\ufffdZ\ufffd\\t\\u0016\\u0010uk\ufffdp\ufffd\ufffdG\ufffd\ufffdP\ufffd .\\u001e\\u0013M\u3dc1;p\\u0007 |\\u0015nr\\u0000\\u0002\ufffd\\u00136t\ufffd\ufffd\ufffd\ufffd5b\ufffd\ufffd^\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffdZ\ufffd\\tuk\ufffdp\ufffd\ufffdG\ufffd\ufffdP\ufffd .M\u3dc1;p |nr\ufffd6t\ufffd\ufffd\ufffd\ufffd5b\ufffd\ufffd^\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031825,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":15171,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.848086977853532, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227ecd4409cf1ae6f8c32de52e0c0621a5\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u00b3\\u0003ZH;|.\\t\ufffd\ufffd%\\u000edIB\\u0010b\ufffd=\ufffdG\ufffd\ufffd\ufffdv\ufffd\ufffdQ.cR \\u001c\ufffd\/|\ufffdf\\u00073\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffdd`Aa\ufffdR\\u0016\ufffd\\u0005\ufffd\u003Cc\ufffd1\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u00b3\\u0003ZH;|.\\t\ufffd\ufffd%\\u000edIB\\u0010b\ufffd=\ufffdG\ufffd\ufffd\ufffdv\ufffd\ufffdQ.cR \\u001c\ufffd\/|\ufffdf\\u00073\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffdd`Aa\ufffdR\\u0016\ufffd\\u0005\ufffd\u003Cc\ufffd1\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u00b3\\u0003ZH;|.\\t\ufffd\ufffd%\\u000edIB\\u0010b\ufffd=\ufffdG\ufffd\ufffd\ufffdv\ufffd\ufffdQ.cR \\u001c\ufffd\/|\ufffdf\\u00073\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffdd`Aa\ufffdR\\u0016\ufffd\\u0005\ufffd\u003Cc\ufffd1\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u00b3\\u0003ZH;|.\\t\ufffd\ufffd%\\u000edIB\\u0010b\ufffd=\ufffdG\ufffd\ufffd\ufffdv\ufffd\ufffdQ.cR \\u001c\ufffd\/|\ufffdf\\u00073\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffdd`Aa\ufffdR\\u0016\ufffd\\u0005\ufffd\u003Cc\ufffd1\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u00b3\\u0003ZH;|.\\t\ufffd\ufffd%\\u000edIB\\u0010b\ufffd=\ufffdG\ufffd\ufffd\ufffdv\ufffd\ufffdQ.cR \\u001c\ufffd\/|\ufffdf\\u00073\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffdd`Aa\ufffdR\\u0016\ufffd\\u0005\ufffd\u003Cc\ufffd1\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002238ae4bb26de765eb41b2511584291443c97f94f3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u00b3\\u0003ZH;|.\\t\ufffd\ufffd%\\u000edIB\\u0010b\ufffd=\ufffdG\ufffd\ufffd\ufffdv\ufffd\ufffdQ.cR \\u001c\ufffd\/|\ufffdf\\u00073\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffdd`Aa\ufffdR\\u0016\ufffd\\u0005\ufffd\u003Cc\ufffd1\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\u00b3ZH;|.\\t\ufffd\ufffd%dIBb\ufffd=\ufffdG\ufffd\ufffd\ufffdv\ufffd\ufffdQ.cR \ufffd\/|\ufffdf3\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffdd`Aa\ufffdR\ufffd\ufffd\u003Cc\ufffd1\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\u00b3\\u0003ZH;|.\\t\ufffd\ufffd%\\u000edIB\\u0010b\ufffd=\ufffdG\ufffd\ufffd\ufffdv\ufffd\ufffdQ.cR \\u001c\ufffd\/|\ufffdf\\u00073\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffdd`Aa\ufffdR\\u0016\ufffd\\u0005\ufffd\u003Cc\ufffd1\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\u00b3ZH;|.\\t\ufffd\ufffd%dIBb\ufffd=\ufffdG\ufffd\ufffd\ufffdv\ufffd\ufffdQ.cR \ufffd\/|\ufffdf3\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffdd`Aa\ufffdR\ufffd\ufffd\u003Cc\ufffd1\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031826,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":14715,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.848233449792993, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002294174f200a910afe9c9429e8aa3a979d\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\ufffd\ufffd\ufffd\\tqCc\ufffd\ufffd\u0027\ufffd\\u0004\ufffdN4\ufffdu\ufffd\ufffd~TTB\\u0018Y\ufffd\ufffd1\ufffdL\\u0013 c\ufffd\ufffd\ufffd7^H\ufffdK#\ufffd\u0495?\\\\]\ufffd\ufffd\u00b2{\ufffd\\u001d\u056e\\t\ufffd\ufffd\ufffd\ufffd\u057d\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\ufffd\ufffd\ufffd\\tqCc\ufffd\ufffd\u0027\ufffd\\u0004\ufffdN4\ufffdu\ufffd\ufffd~TTB\\u0018Y\ufffd\ufffd1\ufffdL\\u0013 c\ufffd\ufffd\ufffd7^H\ufffdK#\ufffd\u0495?\\\\]\ufffd\ufffd\u00b2{\ufffd\\u001d\u056e\\t\ufffd\ufffd\ufffd\ufffd\u057d\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\ufffd\ufffd\ufffd\\tqCc\ufffd\ufffd\u0027\ufffd\\u0004\ufffdN4\ufffdu\ufffd\ufffd~TTB\\u0018Y\ufffd\ufffd1\ufffdL\\u0013 c\ufffd\ufffd\ufffd7^H\ufffdK#\ufffd\u0495?\\\\]\ufffd\ufffd\u00b2{\ufffd\\u001d\u056e\\t\ufffd\ufffd\ufffd\ufffd\u057d\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\ufffd\ufffd\ufffd\\tqCc\ufffd\ufffd\u0027\ufffd\\u0004\ufffdN4\ufffdu\ufffd\ufffd~TTB\\u0018Y\ufffd\ufffd1\ufffdL\\u0013 c\ufffd\ufffd\ufffd7^H\ufffdK#\ufffd\u0495?\\\\]\ufffd\ufffd\u00b2{\ufffd\\u001d\u056e\\t\ufffd\ufffd\ufffd\ufffd\u057d\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\ufffd\ufffd\ufffd\\tqCc\ufffd\ufffd\u0027\ufffd\\u0004\ufffdN4\ufffdu\ufffd\ufffd~TTB\\u0018Y\ufffd\ufffd1\ufffdL\\u0013 c\ufffd\ufffd\ufffd7^H\ufffdK#\ufffd\u0495?\\\\]\ufffd\ufffd\u00b2{\ufffd\\u001d\u056e\\t\ufffd\ufffd\ufffd\ufffd\u057d\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e0fee8b3c6cc35617a81ddba51859c429ec6a0d0\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\ufffd\ufffd\ufffd\\tqCc\ufffd\ufffd\u0027\ufffd\\u0004\ufffdN4\ufffdu\ufffd\ufffd~TTB\\u0018Y\ufffd\ufffd1\ufffdL\\u0013 c\ufffd\ufffd\ufffd7^H\ufffdK#\ufffd\u0495?\\\\]\ufffd\ufffd\u00b2{\ufffd\\u001d\u056e\\t\ufffd\ufffd\ufffd\ufffd\u057d\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdv\ufffd\ufffd\ufffd\\tqCc\ufffd\ufffd\u0027\ufffd\ufffdN4\ufffdu\ufffd\ufffd~TTBY\ufffd\ufffd1\ufffdL c\ufffd\ufffd\ufffd7^H\ufffdK#\ufffd\u0495?\\\\]\ufffd\ufffd\u00b2{\ufffd\u056e\\t\ufffd\ufffd\ufffd\ufffd\u057d\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\ufffd\ufffd\ufffd\\tqCc\ufffd\ufffd\u0027\ufffd\\u0004\ufffdN4\ufffdu\ufffd\ufffd~TTB\\u0018Y\ufffd\ufffd1\ufffdL\\u0013 c\ufffd\ufffd\ufffd7^H\ufffdK#\ufffd\u0495?\\\\]\ufffd\ufffd\u00b2{\ufffd\\u001d\u056e\\t\ufffd\ufffd\ufffd\ufffd\u057d\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdv\ufffd\ufffd\ufffd\\tqCc\ufffd\ufffd\u0027\ufffd\ufffdN4\ufffdu\ufffd\ufffd~TTBY\ufffd\ufffd1\ufffdL c\ufffd\ufffd\ufffd7^H\ufffdK#\ufffd\u0495?\\\\]\ufffd\ufffd\u00b2{\ufffd\u056e\\t\ufffd\ufffd\ufffd\ufffd\u057d\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031827,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":8897,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.826670234188736, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229c8192757eae142df1e0d35714b5f7c0\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003[\ufffd\ufffd\\u0005\\u0000o\\u001e\ufffd\\u0006r\ufffdGW\ufffd\ufffd\ufffd\\u0005\\u0016\u0629\ufffd_\ufffd\ufffdH\ufffd+e.c \ufffd\\u0006X\\u001fl\ufffd[F2\\u0016\ufffd\ufffd\ufffd\ufffd\ufffdZ\\u001eG4Y:)\ufffdB\ufffd#}WB\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003[\ufffd\ufffd\\u0005\\u0000o\\u001e\ufffd\\u0006r\ufffdGW\ufffd\ufffd\ufffd\\u0005\\u0016\u0629\ufffd_\ufffd\ufffdH\ufffd+e.c \ufffd\\u0006X\\u001fl\ufffd[F2\\u0016\ufffd\ufffd\ufffd\ufffd\ufffdZ\\u001eG4Y:)\ufffdB\ufffd#}WB\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003[\ufffd\ufffd\\u0005\\u0000o\\u001e\ufffd\\u0006r\ufffdGW\ufffd\ufffd\ufffd\\u0005\\u0016\u0629\ufffd_\ufffd\ufffdH\ufffd+e.c \ufffd\\u0006X\\u001fl\ufffd[F2\\u0016\ufffd\ufffd\ufffd\ufffd\ufffdZ\\u001eG4Y:)\ufffdB\ufffd#}WB\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d0f8eccf4dccf648816925487204fb901ac7bc7c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003[\ufffd\ufffd\\u0005\\u0000o\\u001e\ufffd\\u0006r\ufffdGW\ufffd\ufffd\ufffd\\u0005\\u0016\u0629\ufffd_\ufffd\ufffdH\ufffd+e.c \ufffd\\u0006X\\u001fl\ufffd[F2\\u0016\ufffd\ufffd\ufffd\ufffd\ufffdZ\\u001eG4Y:)\ufffdB\ufffd#}WB\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd[\ufffd\ufffdo\ufffdr\ufffdGW\ufffd\ufffd\ufffd\u0629\ufffd_\ufffd\ufffdH\ufffd+e.c \ufffdXl\ufffd[F2\ufffd\ufffd\ufffd\ufffd\ufffdZG4Y:)\ufffdB\ufffd#}WB\ufffd\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003[\ufffd\ufffd\\u0005\\u0000o\\u001e\ufffd\\u0006r\ufffdGW\ufffd\ufffd\ufffd\\u0005\\u0016\u0629\ufffd_\ufffd\ufffdH\ufffd+e.c \ufffd\\u0006X\\u001fl\ufffd[F2\\u0016\ufffd\ufffd\ufffd\ufffd\ufffdZ\\u001eG4Y:)\ufffdB\ufffd#}WB\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd[\ufffd\ufffdo\ufffdr\ufffdGW\ufffd\ufffd\ufffd\u0629\ufffd_\ufffd\ufffdH\ufffd+e.c \ufffdXl\ufffd[F2\ufffd\ufffd\ufffd\ufffd\ufffdZG4Y:)\ufffdB\ufffd#}WB\ufffd\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031828,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":9355,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.853449199920903, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002283734b6113ee91db66067a2907df45fe\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\r\ufffd\ufffdD\ufffdyN\ufffd\ufffd\\u0005$\ufffd!l\ufffd\ufffdf\ufffd!\u010e\\u001f\ufffd@\\u0006\ufffd\ufffd\ufffd ,K}\ufffdrP\ufffd;\\u0010\\u0017\ufffd\ufffd\ufffd\ufffdt}\u0026\ufffd\u974f\ufffd\\u001e\\u0003\ufffd;\ufffd;\ufffdG\u0027\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\r\ufffd\ufffdD\ufffdyN\ufffd\ufffd\\u0005$\ufffd!l\ufffd\ufffdf\ufffd!\u010e\\u001f\ufffd@\\u0006\ufffd\ufffd\ufffd ,K}\ufffdrP\ufffd;\\u0010\\u0017\ufffd\ufffd\ufffd\ufffdt}\u0026\ufffd\u974f\ufffd\\u001e\\u0003\ufffd;\ufffd;\ufffdG\u0027\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\r\ufffd\ufffdD\ufffdyN\ufffd\ufffd\\u0005$\ufffd!l\ufffd\ufffdf\ufffd!\u010e\\u001f\ufffd@\\u0006\ufffd\ufffd\ufffd ,K}\ufffdrP\ufffd;\\u0010\\u0017\ufffd\ufffd\ufffd\ufffdt}\u0026\ufffd\u974f\ufffd\\u001e\\u0003\ufffd;\ufffd;\ufffdG\u0027\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227991ad14ff0c5dbff0c63456c88218718c847c45\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\r\ufffd\ufffdD\ufffdyN\ufffd\ufffd\\u0005$\ufffd!l\ufffd\ufffdf\ufffd!\u010e\\u001f\ufffd@\\u0006\ufffd\ufffd\ufffd ,K}\ufffdrP\ufffd;\\u0010\\u0017\ufffd\ufffd\ufffd\ufffdt}\u0026\ufffd\u974f\ufffd\\u001e\\u0003\ufffd;\ufffd;\ufffdG\u0027\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\r\ufffd\ufffdD\ufffdyN\ufffd\ufffd$\ufffd!l\ufffd\ufffdf\ufffd!\u010e\ufffd@\ufffd\ufffd\ufffd ,K}\ufffdrP\ufffd;\ufffd\ufffd\ufffd\ufffdt}\u0026\ufffd\u974f\ufffd\ufffd;\ufffd;\ufffdG\u0027\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\r\ufffd\ufffdD\ufffdyN\ufffd\ufffd\\u0005$\ufffd!l\ufffd\ufffdf\ufffd!\u010e\\u001f\ufffd@\\u0006\ufffd\ufffd\ufffd ,K}\ufffdrP\ufffd;\\u0010\\u0017\ufffd\ufffd\ufffd\ufffdt}\u0026\ufffd\u974f\ufffd\\u001e\\u0003\ufffd;\ufffd;\ufffdG\u0027\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\r\ufffd\ufffdD\ufffdyN\ufffd\ufffd$\ufffd!l\ufffd\ufffdf\ufffd!\u010e\ufffd@\ufffd\ufffd\ufffd ,K}\ufffdrP\ufffd;\ufffd\ufffd\ufffd\ufffdt}\u0026\ufffd\u974f\ufffd\ufffd;\ufffd;\ufffdG\u0027\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031829,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":10029,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.8122743962442245, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ac6414fd6b7d0bc647b4eebaa3d662bf\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0000\\u0016\\u001f!{\\u000f\ufffd=\u0488\ufffd\ufffd\\u0012\ufffd\\u0010\\u0010\ufffdAs\ufffd\ufffd\ufffd\ufffdy\ufffd!}\ufffd\ufffd%\ufffd \ufffd\ufffdOk\ufffdk\ufffd\\t\ufffd\ufffdKW\\u0012\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffdF\ufffd\u0027\ufffd\u0147\\\\\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0000\\u0016\\u001f!{\\u000f\ufffd=\u0488\ufffd\ufffd\\u0012\ufffd\\u0010\\u0010\ufffdAs\ufffd\ufffd\ufffd\ufffdy\ufffd!}\ufffd\ufffd%\ufffd \ufffd\ufffdOk\ufffdk\ufffd\\t\ufffd\ufffdKW\\u0012\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffdF\ufffd\u0027\ufffd\u0147\\\\\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0000\\u0016\\u001f!{\\u000f\ufffd=\u0488\ufffd\ufffd\\u0012\ufffd\\u0010\\u0010\ufffdAs\ufffd\ufffd\ufffd\ufffdy\ufffd!}\ufffd\ufffd%\ufffd \ufffd\ufffdOk\ufffdk\ufffd\\t\ufffd\ufffdKW\\u0012\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffdF\ufffd\u0027\ufffd\u0147\\\\\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002217d0af49544947b213d611280511779b1f4ab62a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0000\\u0016\\u001f!{\\u000f\ufffd=\u0488\ufffd\ufffd\\u0012\ufffd\\u0010\\u0010\ufffdAs\ufffd\ufffd\ufffd\ufffdy\ufffd!}\ufffd\ufffd%\ufffd \ufffd\ufffdOk\ufffdk\ufffd\\t\ufffd\ufffdKW\\u0012\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffdF\ufffd\u0027\ufffd\u0147\\\\\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd!{\ufffd=\u0488\ufffd\ufffd\ufffd\ufffdAs\ufffd\ufffd\ufffd\ufffdy\ufffd!}\ufffd\ufffd%\ufffd \ufffd\ufffdOk\ufffdk\ufffd\\t\ufffd\ufffdKW\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffdF\ufffd\u0027\ufffd\u0147\\\\\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0000\\u0016\\u001f!{\\u000f\ufffd=\u0488\ufffd\ufffd\\u0012\ufffd\\u0010\\u0010\ufffdAs\ufffd\ufffd\ufffd\ufffdy\ufffd!}\ufffd\ufffd%\ufffd \ufffd\ufffdOk\ufffdk\ufffd\\t\ufffd\ufffdKW\\u0012\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffdF\ufffd\u0027\ufffd\u0147\\\\\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd!{\ufffd=\u0488\ufffd\ufffd\ufffd\ufffdAs\ufffd\ufffd\ufffd\ufffdy\ufffd!}\ufffd\ufffd%\ufffd \ufffd\ufffdOk\ufffdk\ufffd\\t\ufffd\ufffdKW\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffdF\ufffd\u0027\ufffd\u0147\\\\\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031830,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":29907,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.836295858302248, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022025732f4c82b836698a8ad6694fb5ee0\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\\u0000\ufffdmr\\u0015\\u0018\\u001ee\ufffd1\ufffdv:\\u0014\u07d4\ufffd\ufffd\ufffd\\u001ev\ufffdX= sE\\u000e\\u0011\ufffd\ufffd\\u0000e\ufffd\\u0011J\ufffd\ufffd\ufffd\\u001a\ufffd\\u001e\ufffd\ufffdT\ufffd*}V\ufffd\ufffdA\\\\\ufffdr\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\\u0000\ufffdmr\\u0015\\u0018\\u001ee\ufffd1\ufffdv:\\u0014\u07d4\ufffd\ufffd\ufffd\\u001ev\ufffdX= sE\\u000e\\u0011\ufffd\ufffd\\u0000e\ufffd\\u0011J\ufffd\ufffd\ufffd\\u001a\ufffd\\u001e\ufffd\ufffdT\ufffd*}V\ufffd\ufffdA\\\\\ufffdr\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\\u0000\ufffdmr\\u0015\\u0018\\u001ee\ufffd1\ufffdv:\\u0014\u07d4\ufffd\ufffd\ufffd\\u001ev\ufffdX= sE\\u000e\\u0011\ufffd\ufffd\\u0000e\ufffd\\u0011J\ufffd\ufffd\ufffd\\u001a\ufffd\\u001e\ufffd\ufffdT\ufffd*}V\ufffd\ufffdA\\\\\ufffdr\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e474a37055fa531b5ab3e710b48c2d671e741a76\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\\u0000\ufffdmr\\u0015\\u0018\\u001ee\ufffd1\ufffdv:\\u0014\u07d4\ufffd\ufffd\ufffd\\u001ev\ufffdX= sE\\u000e\\u0011\ufffd\ufffd\\u0000e\ufffd\\u0011J\ufffd\ufffd\ufffd\\u001a\ufffd\\u001e\ufffd\ufffdT\ufffd*}V\ufffd\ufffdA\\\\\ufffdr\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdmre\ufffd1\ufffdv:\u07d4\ufffd\ufffd\ufffdv\ufffdX= sE\ufffd\ufffde\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd*}V\ufffd\ufffdA\\\\\ufffdr\u003E\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\\u0000\ufffdmr\\u0015\\u0018\\u001ee\ufffd1\ufffdv:\\u0014\u07d4\ufffd\ufffd\ufffd\\u001ev\ufffdX= sE\\u000e\\u0011\ufffd\ufffd\\u0000e\ufffd\\u0011J\ufffd\ufffd\ufffd\\u001a\ufffd\\u001e\ufffd\ufffdT\ufffd*}V\ufffd\ufffdA\\\\\ufffdr\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdmre\ufffd1\ufffdv:\u07d4\ufffd\ufffd\ufffdv\ufffdX= sE\ufffd\ufffde\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd*}V\ufffd\ufffdA\\\\\ufffdr\u003E\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031831,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":21675,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.8135629954576, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c773111c7e13f20552027fa9c75ebfdb\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S\ufffd\u0644L\\u0003[\ufffd\ufffd\ufffd\ufffd\ufffd\\t3\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffda\\u000b%w\ufffd\\u0003(?\ufffd\ufffd\\u001a w \u0026#\ufffde\\u001f\ufffd!\ufffd\ufffdh\ufffd\ufffd\ufffd:\\u001e\ufffdR\ufffdf.\ufffd\\u001b\\u0005\ufffdK]\\fY\ufffd_\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S\ufffd\u0644L\\u0003[\ufffd\ufffd\ufffd\ufffd\ufffd\\t3\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffda\\u000b%w\ufffd\\u0003(?\ufffd\ufffd\\u001a w \u0026#\ufffde\\u001f\ufffd!\ufffd\ufffdh\ufffd\ufffd\ufffd:\\u001e\ufffdR\ufffdf.\ufffd\\u001b\\u0005\ufffdK]\\fY\ufffd_\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S\ufffd\u0644L\\u0003[\ufffd\ufffd\ufffd\ufffd\ufffd\\t3\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffda\\u000b%w\ufffd\\u0003(?\ufffd\ufffd\\u001a w \u0026#\ufffde\\u001f\ufffd!\ufffd\ufffdh\ufffd\ufffd\ufffd:\\u001e\ufffdR\ufffdf.\ufffd\\u001b\\u0005\ufffdK]\\fY\ufffd_\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fa156d7ec021690e05298148bed80d66ee54ec3c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S\ufffd\u0644L\\u0003[\ufffd\ufffd\ufffd\ufffd\ufffd\\t3\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffda\\u000b%w\ufffd\\u0003(?\ufffd\ufffd\\u001a w \u0026#\ufffde\\u001f\ufffd!\ufffd\ufffdh\ufffd\ufffd\ufffd:\\u001e\ufffdR\ufffdf.\ufffd\\u001b\\u0005\ufffdK]\\fY\ufffd_\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdS\ufffd\u0644L[\ufffd\ufffd\ufffd\ufffd\ufffd\\t3\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffda%w\ufffd(?\ufffd\ufffd w \u0026#\ufffde\ufffd!\ufffd\ufffdh\ufffd\ufffd\ufffd:\ufffdR\ufffdf.\ufffd\ufffdK]Y\ufffd_\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S\ufffd\u0644L\\u0003[\ufffd\ufffd\ufffd\ufffd\ufffd\\t3\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffda\\u000b%w\ufffd\\u0003(?\ufffd\ufffd\\u001a w \u0026#\ufffde\\u001f\ufffd!\ufffd\ufffdh\ufffd\ufffd\ufffd:\\u001e\ufffdR\ufffdf.\ufffd\\u001b\\u0005\ufffdK]\\fY\ufffd_\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdS\ufffd\u0644L[\ufffd\ufffd\ufffd\ufffd\ufffd\\t3\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffda%w\ufffd(?\ufffd\ufffd w \u0026#\ufffde\ufffd!\ufffd\ufffdh\ufffd\ufffd\ufffd:\ufffdR\ufffdf.\ufffd\ufffdK]Y\ufffd_\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031832,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":32093,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.805623933250369, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b59910377775f326c11ab81eb0c3c1ff\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003NS\\u0018\ufffd\ufffd\ufffdw\\u000f\\u0006\ufffd0\ufffd+X\ufffd3848\ufffd@GTR\\u000f]\ufffd\ufffdj\ufffdQ\\u0019 W\ufffd\ufffdI\\u0005\\tO07[\\u0014\ufffd\u0026\ufffd\u01a9m\\u0002\ufffd|\ufffd\ufffd\ufffd\ufffdB0o6\ufffd.\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003NS\\u0018\ufffd\ufffd\ufffdw\\u000f\\u0006\ufffd0\ufffd+X\ufffd3848\ufffd@GTR\\u000f]\ufffd\ufffdj\ufffdQ\\u0019 W\ufffd\ufffdI\\u0005\\tO07[\\u0014\ufffd\u0026\ufffd\u01a9m\\u0002\ufffd|\ufffd\ufffd\ufffd\ufffdB0o6\ufffd.\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003NS\\u0018\ufffd\ufffd\ufffdw\\u000f\\u0006\ufffd0\ufffd+X\ufffd3848\ufffd@GTR\\u000f]\ufffd\ufffdj\ufffdQ\\u0019 W\ufffd\ufffdI\\u0005\\tO07[\\u0014\ufffd\u0026\ufffd\u01a9m\\u0002\ufffd|\ufffd\ufffd\ufffd\ufffdB0o6\ufffd.\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003NS\\u0018\ufffd\ufffd\ufffdw\\u000f\\u0006\ufffd0\ufffd+X\ufffd3848\ufffd@GTR\\u000f]\ufffd\ufffdj\ufffdQ\\u0019 W\ufffd\ufffdI\\u0005\\tO07[\\u0014\ufffd\u0026\ufffd\u01a9m\\u0002\ufffd|\ufffd\ufffd\ufffd\ufffdB0o6\ufffd.\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003NS\\u0018\ufffd\ufffd\ufffdw\\u000f\\u0006\ufffd0\ufffd+X\ufffd3848\ufffd@GTR\\u000f]\ufffd\ufffdj\ufffdQ\\u0019 W\ufffd\ufffdI\\u0005\\tO07[\\u0014\ufffd\u0026\ufffd\u01a9m\\u0002\ufffd|\ufffd\ufffd\ufffd\ufffdB0o6\ufffd.\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b5144038f87ad4def343277faae7de61d4f14e92\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003NS\\u0018\ufffd\ufffd\ufffdw\\u000f\\u0006\ufffd0\ufffd+X\ufffd3848\ufffd@GTR\\u000f]\ufffd\ufffdj\ufffdQ\\u0019 W\ufffd\ufffdI\\u0005\\tO07[\\u0014\ufffd\u0026\ufffd\u01a9m\\u0002\ufffd|\ufffd\ufffd\ufffd\ufffdB0o6\ufffd.\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdNS\ufffd\ufffd\ufffdw\ufffd0\ufffd+X\ufffd3848\ufffd@GTR]\ufffd\ufffdj\ufffdQ W\ufffd\ufffdI\\tO07[\ufffd\u0026\ufffd\u01a9m\ufffd|\ufffd\ufffd\ufffd\ufffdB0o6\ufffd.\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003NS\\u0018\ufffd\ufffd\ufffdw\\u000f\\u0006\ufffd0\ufffd+X\ufffd3848\ufffd@GTR\\u000f]\ufffd\ufffdj\ufffdQ\\u0019 W\ufffd\ufffdI\\u0005\\tO07[\\u0014\ufffd\u0026\ufffd\u01a9m\\u0002\ufffd|\ufffd\ufffd\ufffd\ufffdB0o6\ufffd.\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdNS\ufffd\ufffd\ufffdw\ufffd0\ufffd+X\ufffd3848\ufffd@GTR]\ufffd\ufffdj\ufffdQ W\ufffd\ufffdI\\tO07[\ufffd\u0026\ufffd\u01a9m\ufffd|\ufffd\ufffd\ufffd\ufffdB0o6\ufffd.\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031833,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":28887,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.866924332498477, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e36aaee7bddaff3a584725000de45c1e\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u021b\ufffd\u1708\ufffd\ufffd\ufffd\ufffd#\u066f[\ufffd:\u0184\\u000f\\u001f\u053b1\u03f7\\u001a\ufffd\ufffd\\u001d\ufffd \u003C\ufffdD\ufffd\ufffd\\u0010y\u0026\ufffd\ufffd\ufffdI\\u0011\ufffd\u003C6:h\ufffd\ufffd\ufffd\ufffd\ufffd\\u000e\ufffd\ufffd\ufffd!f\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u021b\ufffd\u1708\ufffd\ufffd\ufffd\ufffd#\u066f[\ufffd:\u0184\\u000f\\u001f\u053b1\u03f7\\u001a\ufffd\ufffd\\u001d\ufffd \u003C\ufffdD\ufffd\ufffd\\u0010y\u0026\ufffd\ufffd\ufffdI\\u0011\ufffd\u003C6:h\ufffd\ufffd\ufffd\ufffd\ufffd\\u000e\ufffd\ufffd\ufffd!f\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u021b\ufffd\u1708\ufffd\ufffd\ufffd\ufffd#\u066f[\ufffd:\u0184\\u000f\\u001f\u053b1\u03f7\\u001a\ufffd\ufffd\\u001d\ufffd \u003C\ufffdD\ufffd\ufffd\\u0010y\u0026\ufffd\ufffd\ufffdI\\u0011\ufffd\u003C6:h\ufffd\ufffd\ufffd\ufffd\ufffd\\u000e\ufffd\ufffd\ufffd!f\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221995f2cb95cdb472bac4d4e703e4e91c70c795dd\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u021b\ufffd\u1708\ufffd\ufffd\ufffd\ufffd#\u066f[\ufffd:\u0184\\u000f\\u001f\u053b1\u03f7\\u001a\ufffd\ufffd\\u001d\ufffd \u003C\ufffdD\ufffd\ufffd\\u0010y\u0026\ufffd\ufffd\ufffdI\\u0011\ufffd\u003C6:h\ufffd\ufffd\ufffd\ufffd\ufffd\\u000e\ufffd\ufffd\ufffd!f\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u021b\ufffd\u1708\ufffd\ufffd\ufffd\ufffd#\u066f[\ufffd:\u0184\u053b1\u03f7\ufffd\ufffd\ufffd \u003C\ufffdD\ufffd\ufffdy\u0026\ufffd\ufffd\ufffdI\ufffd\u003C6:h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!f\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\u021b\ufffd\u1708\ufffd\ufffd\ufffd\ufffd#\u066f[\ufffd:\u0184\\u000f\\u001f\u053b1\u03f7\\u001a\ufffd\ufffd\\u001d\ufffd \u003C\ufffdD\ufffd\ufffd\\u0010y\u0026\ufffd\ufffd\ufffdI\\u0011\ufffd\u003C6:h\ufffd\ufffd\ufffd\ufffd\ufffd\\u000e\ufffd\ufffd\ufffd!f\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u021b\ufffd\u1708\ufffd\ufffd\ufffd\ufffd#\u066f[\ufffd:\u0184\u053b1\u03f7\ufffd\ufffd\ufffd \u003C\ufffdD\ufffd\ufffdy\u0026\ufffd\ufffd\ufffdI\ufffd\u003C6:h\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!f\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031834,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":3911,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.813778495049976, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223bcfe943a216d6c30fcc19d7319fed90\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003`E2\ufffd\ufffd\ufffd\u9793$\\u0002\ufffdIv\\u0016$X3\ufffd\\u001e\ufffd\\u0002\ufffd7t\\u0007P\ufffd\ufffd\ufffdd\ufffd \\u0007\ufffd\ufffdd\ufffdK\u031b9\\u001e\\u0001\u00e3=\ufffd\ufffdD;\\u001a\ufffd\ufffd\ufffd(\ufffdR\ufffd\ufffd\\bNF\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003`E2\ufffd\ufffd\ufffd\u9793$\\u0002\ufffdIv\\u0016$X3\ufffd\\u001e\ufffd\\u0002\ufffd7t\\u0007P\ufffd\ufffd\ufffdd\ufffd \\u0007\ufffd\ufffdd\ufffdK\u031b9\\u001e\\u0001\u00e3=\ufffd\ufffdD;\\u001a\ufffd\ufffd\ufffd(\ufffdR\ufffd\ufffd\\bNF\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003`E2\ufffd\ufffd\ufffd\u9793$\\u0002\ufffdIv\\u0016$X3\ufffd\\u001e\ufffd\\u0002\ufffd7t\\u0007P\ufffd\ufffd\ufffdd\ufffd \\u0007\ufffd\ufffdd\ufffdK\u031b9\\u001e\\u0001\u00e3=\ufffd\ufffdD;\\u001a\ufffd\ufffd\ufffd(\ufffdR\ufffd\ufffd\\bNF\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002247cc1bf9137d5c61d3d3f92471cf496c82cb037a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003`E2\ufffd\ufffd\ufffd\u9793$\\u0002\ufffdIv\\u0016$X3\ufffd\\u001e\ufffd\\u0002\ufffd7t\\u0007P\ufffd\ufffd\ufffdd\ufffd \\u0007\ufffd\ufffdd\ufffdK\u031b9\\u001e\\u0001\u00e3=\ufffd\ufffdD;\\u001a\ufffd\ufffd\ufffd(\ufffdR\ufffd\ufffd\\bNF\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd`E2\ufffd\ufffd\ufffd\u9793$\ufffdIv$X3\ufffd\ufffd\ufffd7tP\ufffd\ufffd\ufffdd\ufffd \ufffd\ufffdd\ufffdK\u031b9\u00e3=\ufffd\ufffdD;\ufffd\ufffd\ufffd(\ufffdR\ufffd\ufffdNF\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003`E2\ufffd\ufffd\ufffd\u9793$\\u0002\ufffdIv\\u0016$X3\ufffd\\u001e\ufffd\\u0002\ufffd7t\\u0007P\ufffd\ufffd\ufffdd\ufffd \\u0007\ufffd\ufffdd\ufffdK\u031b9\\u001e\\u0001\u00e3=\ufffd\ufffdD;\\u001a\ufffd\ufffd\ufffd(\ufffdR\ufffd\ufffd\\bNF\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd`E2\ufffd\ufffd\ufffd\u9793$\ufffdIv$X3\ufffd\ufffd\ufffd7tP\ufffd\ufffd\ufffdd\ufffd \ufffd\ufffdd\ufffdK\u031b9\u00e3=\ufffd\ufffdD;\ufffd\ufffd\ufffd(\ufffdR\ufffd\ufffdNF\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031835,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":23229,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.830281873225352, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225599c9943e9f495b12055ad051fa6ddb\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\t\ufffd\\u000f\u052f\ufffdb\ufffd\\\\\ufffd\ufffdI\\u0012\ufffd5=\ufffd\ufffd\ufffdY\ufffdb\ufffd\ufffd\u0580b\ufffd\ufffd \ufffdnc\ufffd\\f3\ufffd\\u0019i\\u0019\\u001d\ufffd*i\ufffd|?\\u000e\ufffd\\n\ufffd\ufffd\ufffd\ufffd|O\ufffd\ufffdL\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\t\ufffd\\u000f\u052f\ufffdb\ufffd\\\\\ufffd\ufffdI\\u0012\ufffd5=\ufffd\ufffd\ufffdY\ufffdb\ufffd\ufffd\u0580b\ufffd\ufffd \ufffdnc\ufffd\\f3\ufffd\\u0019i\\u0019\\u001d\ufffd*i\ufffd|?\\u000e\ufffd\\n\ufffd\ufffd\ufffd\ufffd|O\ufffd\ufffdL\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\t\ufffd\\u000f\u052f\ufffdb\ufffd\\\\\ufffd\ufffdI\\u0012\ufffd5=\ufffd\ufffd\ufffdY\ufffdb\ufffd\ufffd\u0580b\ufffd\ufffd \ufffdnc\ufffd\\f3\ufffd\\u0019i\\u0019\\u001d\ufffd*i\ufffd|?\\u000e\ufffd\\n\ufffd\ufffd\ufffd\ufffd|O\ufffd\ufffdL\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d36358d0300fc693c975c28e8725d1183234cd96\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\t\ufffd\\u000f\u052f\ufffdb\ufffd\\\\\ufffd\ufffdI\\u0012\ufffd5=\ufffd\ufffd\ufffdY\ufffdb\ufffd\ufffd\u0580b\ufffd\ufffd \ufffdnc\ufffd\\f3\ufffd\\u0019i\\u0019\\u001d\ufffd*i\ufffd|?\\u000e\ufffd\\n\ufffd\ufffd\ufffd\ufffd|O\ufffd\ufffdL\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\\t\ufffd\u052f\ufffdb\ufffd\\\\\ufffd\ufffdI\ufffd5=\ufffd\ufffd\ufffdY\ufffdb\ufffd\ufffd\u0580b\ufffd\ufffd \ufffdnc\ufffd3\ufffdi\ufffd*i\ufffd|?\ufffd\\n\ufffd\ufffd\ufffd\ufffd|O\ufffd\ufffdL\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\t\ufffd\\u000f\u052f\ufffdb\ufffd\\\\\ufffd\ufffdI\\u0012\ufffd5=\ufffd\ufffd\ufffdY\ufffdb\ufffd\ufffd\u0580b\ufffd\ufffd \ufffdnc\ufffd\\f3\ufffd\\u0019i\\u0019\\u001d\ufffd*i\ufffd|?\\u000e\ufffd\\n\ufffd\ufffd\ufffd\ufffd|O\ufffd\ufffdL\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\\t\ufffd\u052f\ufffdb\ufffd\\\\\ufffd\ufffdI\ufffd5=\ufffd\ufffd\ufffdY\ufffdb\ufffd\ufffd\u0580b\ufffd\ufffd \ufffdnc\ufffd3\ufffdi\ufffd*i\ufffd|?\ufffd\\n\ufffd\ufffd\ufffd\ufffd|O\ufffd\ufffdL\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031836,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":22581,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.858469951940667, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002260b681ac192a4df9ea28c76490db83eb\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\\\\\ufffd\ufffd:\ufffd\\u0005\ufffd6z?uYN\ufffdH\ufffd\ufffd\ufffd\u003E*\\u001e,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd \ufffd=\u101bj\ufffd)\ufffd\ufffd\ufffd\\u0019e\\u0002\ufffd\ufffd\ufffd\\u0012n\ufffdh~\ufffd\ufffdU\\b\\r9Y\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\\\\\ufffd\ufffd:\ufffd\\u0005\ufffd6z?uYN\ufffdH\ufffd\ufffd\ufffd\u003E*\\u001e,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd \ufffd=\u101bj\ufffd)\ufffd\ufffd\ufffd\\u0019e\\u0002\ufffd\ufffd\ufffd\\u0012n\ufffdh~\ufffd\ufffdU\\b\\r9Y\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\\\\\ufffd\ufffd:\ufffd\\u0005\ufffd6z?uYN\ufffdH\ufffd\ufffd\ufffd\u003E*\\u001e,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd \ufffd=\u101bj\ufffd)\ufffd\ufffd\ufffd\\u0019e\\u0002\ufffd\ufffd\ufffd\\u0012n\ufffdh~\ufffd\ufffdU\\b\\r9Y\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d8c928fd6a8ec2d76d5cd724285901f1d4836364\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\\\\\ufffd\ufffd:\ufffd\\u0005\ufffd6z?uYN\ufffdH\ufffd\ufffd\ufffd\u003E*\\u001e,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd \ufffd=\u101bj\ufffd)\ufffd\ufffd\ufffd\\u0019e\\u0002\ufffd\ufffd\ufffd\\u0012n\ufffdh~\ufffd\ufffdU\\b\\r9Y\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd+\ufffd\\\\\ufffd\ufffd:\ufffd\ufffd6z?uYN\ufffdH\ufffd\ufffd\ufffd\u003E*,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd \ufffd=\u101bj\ufffd)\ufffd\ufffd\ufffde\ufffd\ufffd\ufffdn\ufffdh~\ufffd\ufffdU\\r9Y\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003+\ufffd\\\\\ufffd\ufffd:\ufffd\\u0005\ufffd6z?uYN\ufffdH\ufffd\ufffd\ufffd\u003E*\\u001e,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd \ufffd=\u101bj\ufffd)\ufffd\ufffd\ufffd\\u0019e\\u0002\ufffd\ufffd\ufffd\\u0012n\ufffdh~\ufffd\ufffdU\\b\\r9Y\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd+\ufffd\\\\\ufffd\ufffd:\ufffd\ufffd6z?uYN\ufffdH\ufffd\ufffd\ufffd\u003E*,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd \ufffd=\u101bj\ufffd)\ufffd\ufffd\ufffde\ufffd\ufffd\ufffdn\ufffdh~\ufffd\ufffdU\\r9Y\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031837,"ip":"207.154.210.146","ts":"2026-07-27 20:41:00.000000","proto":"tcp","src_port":22661,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.8666022455043905, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022eb915b5a787d9d62677dd9a4038fbac2\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003V\ufffd\u12fbo\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd;~\\u001cL\ufffdl\ufffd~%\ufffd\ufffd:\ufffd*\\u0012\\\\\ufffd \ufffd\ufffd\\u001a\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\\u0012\ufffd\\u001e\ufffd\ufffd\ufffdv\ufffd\u063d\ufffdX\ufffd\ufffd\\r@\\u000f\\u001d\ufffdO\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003V\ufffd\u12fbo\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd;~\\u001cL\ufffdl\ufffd~%\ufffd\ufffd:\ufffd*\\u0012\\\\\ufffd \ufffd\ufffd\\u001a\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\\u0012\ufffd\\u001e\ufffd\ufffd\ufffdv\ufffd\u063d\ufffdX\ufffd\ufffd\\r@\\u000f\\u001d\ufffdO\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003V\ufffd\u12fbo\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd;~\\u001cL\ufffdl\ufffd~%\ufffd\ufffd:\ufffd*\\u0012\\\\\ufffd \ufffd\ufffd\\u001a\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\\u0012\ufffd\\u001e\ufffd\ufffd\ufffdv\ufffd\u063d\ufffdX\ufffd\ufffd\\r@\\u000f\\u001d\ufffdO\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022edd7e760774b2d00134b3f69bd567ac2f91f74f9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003V\ufffd\u12fbo\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd;~\\u001cL\ufffdl\ufffd~%\ufffd\ufffd:\ufffd*\\u0012\\\\\ufffd \ufffd\ufffd\\u001a\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\\u0012\ufffd\\u001e\ufffd\ufffd\ufffdv\ufffd\u063d\ufffdX\ufffd\ufffd\\r@\\u000f\\u001d\ufffdO\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdV\ufffd\u12fbo\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd;~L\ufffdl\ufffd~%\ufffd\ufffd:\ufffd*\\\\\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd\u063d\ufffdX\ufffd\ufffd\\r@\ufffdO\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003V\ufffd\u12fbo\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd;~\\u001cL\ufffdl\ufffd~%\ufffd\ufffd:\ufffd*\\u0012\\\\\ufffd \ufffd\ufffd\\u001a\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\\u0012\ufffd\\u001e\ufffd\ufffd\ufffdv\ufffd\u063d\ufffdX\ufffd\ufffd\\r@\\u000f\\u001d\ufffdO\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdV\ufffd\u12fbo\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd;~L\ufffdl\ufffd~%\ufffd\ufffd:\ufffd*\\\\\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd\u063d\ufffdX\ufffd\ufffd\\r@\ufffdO\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517},{"id":14031802,"ip":"207.154.210.146","ts":"2026-07-27 20:40:59.000000","proto":"tcp","src_port":2557,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.823952456029799, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002231d5cdb8cb1f3e3bc92b1d3c4d5163d8\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001e\\u0002\\u000e\ufffd%a0?\\u0016C\ufffd\\\\\ufffd8\ufffd\ufffd$\ufffd\ufffd,Sp;\\u0012\ufffd\ufffd$\ufffd58\ufffds .\\u0019\ufffd\\u0002\ufffdt,\ufffdUB\u0396\ufffd\u03dd\ufffd\\u000f2\\t\ufffd\\u000fZ\\u0000\ufffd\u0589=}\ufffd\\u000e-\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001e\\u0002\\u000e\ufffd%a0?\\u0016C\ufffd\\\\\ufffd8\ufffd\ufffd$\ufffd\ufffd,Sp;\\u0012\ufffd\ufffd$\ufffd58\ufffds .\\u0019\ufffd\\u0002\ufffdt,\ufffdUB\u0396\ufffd\u03dd\ufffd\\u000f2\\t\ufffd\\u000fZ\\u0000\ufffd\u0589=}\ufffd\\u000e-\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u001d\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001e\\u0002\\u000e\ufffd%a0?\\u0016C\ufffd\\\\\ufffd8\ufffd\ufffd$\ufffd\ufffd,Sp;\\u0012\ufffd\ufffd$\ufffd58\ufffds .\\u0019\ufffd\\u0002\ufffdt,\ufffdUB\u0396\ufffd\u03dd\ufffd\\u000f2\\t\ufffd\\u000fZ\\u0000\ufffd\u0589=}\ufffd\\u000e-\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226d7b1ae42ea549b5086fe6693278738d07dee3bb\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001e\\u0002\\u000e\ufffd%a0?\\u0016C\ufffd\\\\\ufffd8\ufffd\ufffd$\ufffd\ufffd,Sp;\\u0012\ufffd\ufffd$\ufffd58\ufffds .\\u0019\ufffd\\u0002\ufffdt,\ufffdUB\u0396\ufffd\u03dd\ufffd\\u000f2\\t\ufffd\\u000fZ\\u0000\ufffd\u0589=}\ufffd\\u000e-\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd%a0?C\ufffd\\\\\ufffd8\ufffd\ufffd$\ufffd\ufffd,Sp;\ufffd\ufffd$\ufffd58\ufffds .\ufffd\ufffdt,\ufffdUB\u0396\ufffd\u03dd\ufffd2\\t\ufffdZ\ufffd\u0589=}\ufffd-\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u001e\\u0002\\u000e\ufffd%a0?\\u0016C\ufffd\\\\\ufffd8\ufffd\ufffd$\ufffd\ufffd,Sp;\\u0012\ufffd\ufffd$\ufffd58\ufffds .\\u0019\ufffd\\u0002\ufffdt,\ufffdUB\u0396\ufffd\u03dd\ufffd\\u000f2\\t\ufffd\\u000fZ\\u0000\ufffd\u0589=}\ufffd\\u000e-\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd%a0?C\ufffd\\\\\ufffd8\ufffd\ufffd$\ufffd\ufffd,Sp;\ufffd\ufffd$\ufffd58\ufffds .\ufffd\ufffdt,\ufffdUB\u0396\ufffd\u03dd\ufffd2\\t\ufffdZ\ufffd\u0589=}\ufffd-\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":517}],"total_events":140}