{"ip":"209.97.138.155","exported_at":"2026-07-25T04:55:49+00:00","period_days":7,"metrics":{"events7d":15,"distinct_ports":2,"distinct_classifications":5,"max_severity":7,"last_sensor_id":"paris-1","max_waf_score":7,"max_risk_score":42,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ddos"],"recommended_action":"monitor","confidence":0.58,"risk_breakdown":{"waf":36,"classification":68,"behavior":0,"geo":40,"protocol":43,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"TA0001","top_mitre_technique":"TA0007","top_mitre_count":13,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 40\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)","campaign_hint_fr":null,"confidence_breakdown":{"waf":36,"classification":68,"behavior":0,"geo":40,"protocol":43,"novelty":15,"risk_score":40,"correlation_boost":8},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["multi_protocol_correlation"],"correlation_flags_labels_fr":["Multi-protocole corr\u00e9l\u00e9 (5 min)"],"confidence_pct":58,"confidence_hint_fr":"Corr\u00e9lation +8","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0771"],"tags_summary":["pat-0771"],"attack_vector":"slowloris \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 0D95ny{.\u054cQg\u003EK\u0014X0xg@","protocol_details":{"http_method":"\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003v","http_path":"0D95ny{.\u054cQg\u003EK\u0014X0xg@","request_line":"\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003V 0D95ny{.\u054cQg\u003EK\u0014X0xg@ HTTP\/1.1","port":8080,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003v 0D95ny{.\u054cQg\u003EK\u0014X0xg@ \u00b7 HTTP:8080","evidence_snippet":"\ufffd\ufffdv\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg\u003EK\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\ufffd\u0022-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd{h\ufffd\ufffd\r\ufffd\ufffd\ufffdF\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd","target_port_label":"8080 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF","classification_reason":"Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 58 % \u2014 Score WAF 36 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF","payload_preview":"\ufffd\ufffdv\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg\u003EK\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\ufffd\u0022-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd{h\ufffd\ufffd\r\ufffd\ufffd\ufffdF\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd"},"events":[{"id":13563620,"ip":"209.97.138.155","ts":"2026-07-24 16:21:09.000000","proto":"tcp","src_port":58768,"dst_port":8080,"service":"http","classification":"slowloris","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0002\u0001\u0001\u0000\u0001\u0003\u0002","http_target":"RX\u0003B\u0019n{Pk","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00227900a478452ac6b22a7c34695ffc3d82f201527b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\\u0001\\u0000\\u0001\\u0003\\u0002\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 413, \u0022payload_entropy\u0022: 5.946160028739637, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229cd299e962b35aecbc71240c0346f5dedecfed21\u0022, \u0022event_fingerprint\u0022: \u00229b67d269cf92a9c8b9ed2467f131f0ac87c1fd7c\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022546430e9e4e20878635d8c0b455b273a\u0022, \u0022path_pattern_hash\u0022: \u00225aba74526280cd562b41279497ddbb17\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 39}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\\u0001\\u0000\\u0001\\u0003\\u0002\u0022, \u0022path\u0022: \u0022RX\\u0003B\\u0019n{Pk\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\\u0001\\u0000\\u0001\\u0003\\u0002 RX\\u0003B\\u0019n{Pk HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\ufffd\\r\ufffd\ufffdR\ufffdX\ufffd\\u0003\ufffd\ufffdB\\u0019\ufffdn\ufffd{\ufffdPk \\u0000\\u0019\ufffd\ufffdn\ufffd\ufffdm\\u0017q \ufffd\ufffd}\ufffd\ufffd\\u001d \ufffd\ufffd\u078a\ufffda\\u0014F;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\\u0001\\u0000\\u0001\\u0003\\u0002\u0022, \u0022path\u0022: \u0022RX\\u0003B\\u0019n{Pk\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\\u0001\\u0000\\u0001\\u0003\\u0002 RX\\u0003B\\u0019n{Pk HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\ufffd\\r\ufffd\ufffdR\ufffdX\ufffd\\u0003\ufffd\ufffdB\\u0019\ufffdn\ufffd{\ufffdPk \\u0000\\u0019\ufffd\ufffdn\ufffd\ufffdm\\u0017q \ufffd\ufffd}\ufffd\ufffd\\u001d \ufffd\ufffd\u078a\ufffda\\u0014F;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\ufffd\\r\ufffd\ufffdR\ufffdX\ufffd\\u0003\ufffd\ufffdB\\u0019\ufffdn\ufffd{\ufffdPk \\u0000\\u0019\ufffd\ufffdn\ufffd\ufffdm\\u0017q \ufffd\ufffd}\ufffd\ufffd\\u001d \ufffd\ufffd\u078a\ufffda\\u0014F;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222b33d6d6504ca4bc777df88fdbdd561a76930a53\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\\u0001\\u0000\\u0001\\u0003\\u0002\u0022, \u0022http_path\u0022: \u0022RX\\u0003B\\u0019n{Pk\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\\u0001\\u0000\\u0001\\u0003\\u0002 RX\\u0003B\\u0019n{Pk HTTP\/1.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\r\ufffd\ufffdR\ufffdX\ufffd\ufffd\ufffdB\ufffdn\ufffd{\ufffdPk \ufffd\ufffdn\ufffd\ufffdmq \ufffd\ufffd}\ufffd\ufffd \ufffd\ufffd\u078a\ufffdaF;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 RX\\u0003B\\u0019n{Pk\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\\u0001\\u0000\\u0001\\u0003\\u0002\u0022, \u0022http_path\u0022: \u0022RX\\u0003B\\u0019n{Pk\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\\u0001\\u0000\\u0001\\u0003\\u0002 RX\\u0003B\\u0019n{Pk HTTP\/1.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 RX\\u0003B\\u0019n{Pk\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\r\ufffd\ufffdR\ufffdX\ufffd\ufffd\ufffdB\ufffdn\ufffd{\ufffdPk \ufffd\ufffdn\ufffd\ufffdmq \ufffd\ufffd}\ufffd\ufffd \ufffd\ufffd\u078a\ufffdaF;\ufffd{\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"\u0000\u0019nm\u0017q","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":413},{"id":13563621,"ip":"209.97.138.155","ts":"2026-07-24 16:21:09.000000","proto":"tcp","src_port":58800,"dst_port":8080,"service":"http","classification":"slowloris","waf_score":7,"waf_tags":"[\u0022950324:rce-0\u0022]","http_method":"\u0016\u0003\u0001\u0001\u0001\u0000\u0001\u0003\u0003v","http_target":"0D95ny{.\u054cQg\u003EK\u0014X0xg@","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022\u057cqg\u003Ek\\u0014x0xg@\u0022, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u00223eb9e1f052b8d4e77e083763b3ba3bfbe065f672\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003v\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 416, \u0022payload_entropy\u0022: 5.932870283350434, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 36.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f0fc49105ee09e77f9b1bf446ecd909acfcf588\u0022, \u0022event_fingerprint\u0022: \u002202cf4a08912a2b143eef8eeedb9cb892cdeb0a7e\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d4762568c4e866052ba09bf040b7a013\u0022, \u0022path_pattern_hash\u0022: \u0022c59fe6c20e1f48b5edb5f5acbc67e4dc\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003v\u0022, \u0022path\u0022: \u00220D95ny{.\u054cQg\u003EK\\u0014X0xg@\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003V 0D95ny{.\u054cQg\u003EK\\u0014X0xg@ HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\\f\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg\u003EK\\u0014\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\\u0007\ufffd\\\u0022-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd\\u0000{h\ufffd\ufffd\\r\ufffd\ufffd\ufffdF\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003v\u0022, \u0022path\u0022: \u00220D95ny{.\u054cQg\u003EK\\u0014X0xg@\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022], \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003V 0D95ny{.\u054cQg\u003EK\\u0014X0xg@ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\\f\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg\u003EK\\u0014\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\\u0007\ufffd\\\u0022-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd\\u0000{h\ufffd\ufffd\\r\ufffd\ufffd\ufffdF\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003v\\f\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg\u003EK\\u0014\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\\u0007\ufffd\\\u0022-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd\\u0000{h\ufffd\ufffd\\r\ufffd\ufffd\ufffdF\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a73d7a6d99d305ec2738483d0c50667fcea32b30\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003v\u0022, \u0022http_path\u0022: \u00220D95ny{.\u054cQg\u003EK\\u0014X0xg@\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003V 0D95ny{.\u054cQg\u003EK\\u0014X0xg@ HTTP\/1.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdv\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg\u003EK\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\ufffd\\\u0022-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd{h\ufffd\ufffd\\r\ufffd\ufffd\ufffdF\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 0D95ny{.\u054cQg\u003EK\\u0014X0xg@\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 40\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003v\u0022, \u0022http_path\u0022: \u00220D95ny{.\u054cQg\u003EK\\u0014X0xg@\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003V 0D95ny{.\u054cQg\u003EK\\u0014X0xg@ HTTP\/1.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:8080 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 0D95ny{.\u054cQg\u003EK\\u0014X0xg@\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdv\ufffd0\ufffd\ufffdD95ny\ufffd{.\ufffd\u054c\ufffd\ufffdQg\u003EK\ufffdX0\ufffdxg\ufffd@ \ufffdG\ufffd\ufffd\\\u0022-\ufffdF\ufffdh\ufffd\ufffd\ufffdd8Z\ufffdK\ufffd{h\ufffd\ufffd\\r\ufffd\ufffd\ufffdF\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 36 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"G\u0007\u0022-Fhd8ZK\u0000{h","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":416},{"id":13563606,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51022,"dst_port":4443,"service":"pharos","classification":"pharos","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 424, \u0022payload_entropy\u0022: 6.03426480738868, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222d6f4e9dc7e0432435fc4661a569febb\u0022, \u0022path_pattern_hash\u0022: \u00228653057a4b57183ce71278ca80dbd82a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\\u0017\ufffd-\ufffd\ufffd\\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \\u00123M\ufffdL\u003C\ufffd\u0254\ufffd\ufffd\ufffdG|\\u000e\ufffd\ufffdn\\u0007q?\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\\u0017\ufffd-\ufffd\ufffd\\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \\u00123M\ufffdL\u003C\ufffd\u0254\ufffd\ufffd\ufffdG|\\u000e\ufffd\ufffdn\\u0007q?\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\\u0014\ufffd\/\ufffd\u0027\ufffd\\u0013\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\\u0017\ufffd-\ufffd\ufffd\\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \\u00123M\ufffdL\u003C\ufffd\u0254\ufffd\ufffd\ufffdG|\\u000e\ufffd\ufffdn\\u0007q?\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fefe000a5f801c240ffb171f75d527b203e39999\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\\u0017\ufffd-\ufffd\ufffd\\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \\u00123M\ufffdL\u003C\ufffd\u0254\ufffd\ufffd\ufffdG|\\u000e\ufffd\ufffdn\\u0007q?\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdY\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd 3M\ufffdL\u003C\ufffd\u0254\ufffd\ufffd\ufffdG|\ufffd\ufffdnq?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003Y\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\\u0017\ufffd-\ufffd\ufffd\\u0002\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd \\u00123M\ufffdL\u003C\ufffd\u0254\ufffd\ufffd\ufffdG|\\u000e\ufffd\ufffdn\\u0007q?\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdY\ufffd\ufffd\ufffd!`:\ufffdo\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd%K.E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd` \ufffd\ufffd\ufffdRel\ufffd\ufffd 3M\ufffdL\u003C\ufffd\u0254\ufffd\ufffd\ufffdG|\ufffd\ufffdnq?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":424},{"id":13563607,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51036,"dst_port":4443,"service":"pharos","classification":"coap_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 345, \u0022payload_entropy\u0022: 6.072844458293377, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 42.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 60, \u0022precision_signals\u0022: [\u0022pat-0798\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0798\u0022], \u0022matched_patterns\u0022: [\u0022pat-0798\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Sigma CoAP GET\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0798\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 51.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002250be40c8290e21cef2a69226fcae31c8\u0022, \u0022path_pattern_hash\u0022: \u00222bc9f93b3f58e74e96efca118403941c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\\u0014\ufffd\ufffdM\\u0002\ufffd\u02f2\u0239\ufffd;`\\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA\u003E3 4\ufffd\ufffd\u003C:\ufffd\ufffdT\ufffd@\\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd\u0026Az8\ufffd\ufffdZr\\u0000\ufffd+\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\\u0014\ufffd\ufffdM\\u0002\ufffd\u02f2\u0239\ufffd;`\\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA\u003E3 4\ufffd\ufffd\u003C:\ufffd\ufffdT\ufffd@\\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd\u0026Az8\ufffd\ufffdZr\\u0000\ufffd+\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\u003C\\u0000:\\bhttp\/0.9\\bhttp\/1.0\\bhttp\/1.1\\u0006spdy\/1\\u0006spdy\/2\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\\u0014\ufffd\ufffdM\\u0002\ufffd\u02f2\u0239\ufffd;`\\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA\u003E3 4\ufffd\ufffd\u003C:\ufffd\ufffdT\ufffd@\\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd\u0026Az8\ufffd\ufffdZr\\u0000\ufffd+\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fbdcd289eb0fdd67827f3ea55c58bbeeae126ad9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\\u0014\ufffd\ufffdM\\u0002\ufffd\u02f2\u0239\ufffd;`\\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA\u003E3 4\ufffd\ufffd\u003C:\ufffd\ufffdT\ufffd@\\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd\u0026Az8\ufffd\ufffdZr\\u0000\ufffd+\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022TP\ufffd\ufffdM\ufffd\u02f2\u0239\ufffd;`pQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA\u003E3 4\ufffd\ufffd\u003C:\ufffd\ufffdT\ufffd@r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd\u0026Az8\ufffd\ufffdZr\ufffd+F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\u0022, \u0022attack_vector\u0022: \u0022coap probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0798\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0798\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001T\\u0001\\u0000\\u0001P\\u0003\\u0003\\u0014\ufffd\ufffdM\\u0002\ufffd\u02f2\u0239\ufffd;`\\u001apQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA\u003E3 4\ufffd\ufffd\u003C:\ufffd\ufffdT\ufffd@\\u0001r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd\u0026Az8\ufffd\ufffdZr\\u0000\ufffd+\\u0000F\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022coap probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022TP\ufffd\ufffdM\ufffd\u02f2\u0239\ufffd;`pQ\ufffd\ufffd\ufffd`\ufffd4\ufffd\u04e6+]\ufffdA\u003E3 4\ufffd\ufffd\u003C:\ufffd\ufffdT\ufffd@r\ufffd\ufffdC\/\ufffdKo\ufffd\ufffd\u0026Az8\ufffd\ufffdZr\ufffd+F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 51 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":345},{"id":13563608,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51038,"dst_port":4443,"service":"pharos","classification":"pharos","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 331, \u0022payload_entropy\u0022: 5.978402628812989, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e279ab35db0ec11cef1dc3067d5b7546\u0022, \u0022path_pattern_hash\u0022: \u00228653057a4b57183ce71278ca80dbd82a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdAy\ufffd\\fj\ufffd{Y3\u0026\ufffd\ufffd\\u0012v\ufffd\\u0015\ufffd\ufffdwG8\ufffdA\u003E\ufffd\ufffd0\\u0013\\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\\u0004\\u0005\ufffd\ufffdu\\f\ufffdV\ufffd\u04f3\\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdAy\ufffd\\fj\ufffd{Y3\u0026\ufffd\ufffd\\u0012v\ufffd\\u0015\ufffd\ufffdwG8\ufffdA\u003E\ufffd\ufffd0\\u0013\\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\\u0004\\u0005\ufffd\ufffdu\\f\ufffdV\ufffd\u04f3\\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u00000\\u0000.\\bhttp\/0.9\\bhttp\/1.0\\u0006spdy\/1\\u0006spdy\/2\\u0006spdy\/3\\u0003h2c\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdAy\ufffd\\fj\ufffd{Y3\u0026\ufffd\ufffd\\u0012v\ufffd\\u0015\ufffd\ufffdwG8\ufffdA\u003E\ufffd\ufffd0\\u0013\\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\\u0004\\u0005\ufffd\ufffdu\\f\ufffdV\ufffd\u04f3\\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bbfd4cdafb7976bdefaf0e3be1337c4f9e1178a9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdAy\ufffd\\fj\ufffd{Y3\u0026\ufffd\ufffd\\u0012v\ufffd\\u0015\ufffd\ufffdwG8\ufffdA\u003E\ufffd\ufffd0\\u0013\\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\\u0004\\u0005\ufffd\ufffdu\\f\ufffdV\ufffd\u04f3\\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022FB\ufffdAy\ufffdj\ufffd{Y3\u0026\ufffd\ufffdv\ufffd\ufffd\ufffdwG8\ufffdA\u003E\ufffd\ufffd0\ufffd ~=\u0146\ufffd\ufffd\ufffdz\ufffd\ufffdu\ufffdV\ufffd\u04f31\ufffd=s%yH\ufffdk \ufffd\ufffdD\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001F\\u0001\\u0000\\u0001B\\u0003\\u0003\ufffdAy\ufffd\\fj\ufffd{Y3\u0026\ufffd\ufffd\\u0012v\ufffd\\u0015\ufffd\ufffdwG8\ufffdA\u003E\ufffd\ufffd0\\u0013\\u0010\ufffd ~=\u0146\ufffd\ufffd\ufffdz\\u0004\\u0005\ufffd\ufffdu\\f\ufffdV\ufffd\u04f3\\u000e1\ufffd=s%yH\ufffdk \ufffd\ufffd\\u0000D\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022FB\ufffdAy\ufffdj\ufffd{Y3\u0026\ufffd\ufffdv\ufffd\ufffd\ufffdwG8\ufffdA\u003E\ufffd\ufffd0\ufffd ~=\u0146\ufffd\ufffd\ufffdz\ufffd\ufffdu\ufffdV\ufffd\u04f31\ufffd=s%yH\ufffdk \ufffd\ufffdD\ufffd\ufffd\u0027\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\\n\/\u003C\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":331},{"id":13563609,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51054,"dst_port":4443,"service":"pharos","classification":"pharos","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 412, \u0022payload_entropy\u0022: 5.923360733356842, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fc556d75938aa0b7877cae42d5a0b336\u0022, \u0022path_pattern_hash\u0022: \u00228653057a4b57183ce71278ca80dbd82a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003km\\u001d\\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\\f?\ufffdJ\ufffd#\ufffd\\u001c\ufffd\\u0015\\u0010\ufffd \ufffdxo\\t~\u0761p\\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd5$y\u0026\ufffd\ufffdhV\u01a9l\\n\u0026\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003km\\u001d\\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\\f?\ufffdJ\ufffd#\ufffd\\u001c\ufffd\\u0015\\u0010\ufffd \ufffdxo\\t~\u0761p\\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd5$y\u0026\ufffd\ufffdhV\u01a9l\\n\u0026\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\ufffd\\n\\u0013\\u0004\ufffd+\\u0013\\u0003\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\\u0011\ufffd#\\u0000\\n\ufffd\\t\\u0000\/\ufffd\\b\\u0000\u003C\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u00005\\u0000E\\u0000=\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000k\\u0000A\\u00009\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\\u0007\\u0000g\\u0000\\u0004\\u00003\\u0000\\u0005\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003km\\u001d\\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\\f?\ufffdJ\ufffd#\ufffd\\u001c\ufffd\\u0015\\u0010\ufffd \ufffdxo\\t~\u0761p\\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd5$y\u0026\ufffd\ufffdhV\u01a9l\\n\u0026\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022899e66959345f37aedb49db7dae778deb445cc6b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003km\\u001d\\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\\f?\ufffdJ\ufffd#\ufffd\\u001c\ufffd\\u0015\\u0010\ufffd \ufffdxo\\t~\u0761p\\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd5$y\u0026\ufffd\ufffdhV\u01a9l\\n\u0026\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdkm\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd?\ufffdJ\ufffd#\ufffd\ufffd\ufffd \ufffdxo\\t~\u0761p\u0527f\ufffd\ufffd\ufffd\ufffd\ufffd5$y\u0026\ufffd\ufffdhV\u01a9l\\n\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003km\\u001d\\u0016\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd\\f?\ufffdJ\ufffd#\ufffd\\u001c\ufffd\\u0015\\u0010\ufffd \ufffdxo\\t~\u0761p\\u0016\u0527f\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd5$y\u0026\ufffd\ufffdhV\u01a9l\\n\u0026\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdkm\ufffdf2\ufffd*\ufffd\ufffd\ufffdl\u02fap\ufffd=S\ufffd?\ufffdJ\ufffd#\ufffd\ufffd\ufffd \ufffdxo\\t~\u0761p\u0527f\ufffd\ufffd\ufffd\ufffd\ufffd5$y\u0026\ufffd\ufffdhV\u01a9l\\n\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":412},{"id":13563610,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51062,"dst_port":4443,"service":"pharos","classification":"pharos","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 413, \u0022payload_entropy\u0022: 6.024924597470011, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022689d0effbc517e2f5e0042843760355a\u0022, \u0022path_pattern_hash\u0022: \u00228653057a4b57183ce71278ca80dbd82a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\\u0015\ufffd\ufffd\ufffd\\u00175\ufffd\ufffd(\\u0000n\ufffd\ufffd\u0027\ufffd\\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd\u0026\u0027 \ufffd\ufffd\\u000b HtO2\\u001f$\ufffd9\ufffd\ufffd\u0026\ufffd\\u001cGA\ufffdR\\rj\\r\ufffd\ufffd\\u0015\u0027\ufffd\u003E\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\\u0015\ufffd\ufffd\ufffd\\u00175\ufffd\ufffd(\\u0000n\ufffd\ufffd\u0027\ufffd\\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd\u0026\u0027 \ufffd\ufffd\\u000b HtO2\\u001f$\ufffd9\ufffd\ufffd\u0026\ufffd\\u001cGA\ufffdR\\rj\\r\ufffd\ufffd\\u0015\u0027\ufffd\u003E\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\\u0015\ufffd\ufffd\ufffd\\u00175\ufffd\ufffd(\\u0000n\ufffd\ufffd\u0027\ufffd\\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd\u0026\u0027 \ufffd\ufffd\\u000b HtO2\\u001f$\ufffd9\ufffd\ufffd\u0026\ufffd\\u001cGA\ufffdR\\rj\\r\ufffd\ufffd\\u0015\u0027\ufffd\u003E\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b54cb634b35274383ceae5bb63ee18e51a8e9368\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\\u0015\ufffd\ufffd\ufffd\\u00175\ufffd\ufffd(\\u0000n\ufffd\ufffd\u0027\ufffd\\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd\u0026\u0027 \ufffd\ufffd\\u000b HtO2\\u001f$\ufffd9\ufffd\ufffd\u0026\ufffd\\u001cGA\ufffdR\\rj\\r\ufffd\ufffd\\u0015\u0027\ufffd\u003E\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd(n\ufffd\ufffd\u0027\ufffdin\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd\u0026\u0027 \ufffd\ufffd HtO2$\ufffd9\ufffd\ufffd\u0026\ufffdGA\ufffdR\\rj\\r\ufffd\ufffd\u0027\ufffd\u003E\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0002\\u0015\ufffd\ufffd\ufffd\\u00175\ufffd\ufffd(\\u0000n\ufffd\ufffd\u0027\ufffd\\u0018in\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd\u0026\u0027 \ufffd\ufffd\\u000b HtO2\\u001f$\ufffd9\ufffd\ufffd\u0026\ufffd\\u001cGA\ufffdR\\rj\\r\ufffd\ufffd\\u0015\u0027\ufffd\u003E\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd(n\ufffd\ufffd\u0027\ufffdin\ufffd\ufffd%\ufffd\ufffdY7KA\ufffd~\ufffd\u0026\u0027 \ufffd\ufffd HtO2$\ufffd9\ufffd\ufffd\u0026\ufffdGA\ufffdR\\rj\\r\ufffd\ufffd\u0027\ufffd\u003E\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":413},{"id":13563611,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51072,"dst_port":4443,"service":"pharos","classification":"pharos","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 426, \u0022payload_entropy\u0022: 5.9543850910122265, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a61cc7e27b54eaeb92f5ef66ec1cb8a0\u0022, \u0022path_pattern_hash\u0022: \u00228653057a4b57183ce71278ca80dbd82a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd\u0027C\u0027\ufffdr\\u001e\ufffd\ufffdJ\ufffd\ufffd\\t \\u001f\ufffdg\ufffd\ufffd\\u0014\\u0019\ufffd\ufffd\ufffd\\u0000D\ufffdf]|\u05b0Hd\\u001aw\\u0007is8\\u001b6\ufffd=i\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd\u0027C\u0027\ufffdr\\u001e\ufffd\ufffdJ\ufffd\ufffd\\t \\u001f\ufffdg\ufffd\ufffd\\u0014\\u0019\ufffd\ufffd\ufffd\\u0000D\ufffdf]|\u05b0Hd\\u001aw\\u0007is8\\u001b6\ufffd=i\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd\u0027C\u0027\ufffdr\\u001e\ufffd\ufffdJ\ufffd\ufffd\\t \\u001f\ufffdg\ufffd\ufffd\\u0014\\u0019\ufffd\ufffd\ufffd\\u0000D\ufffdf]|\u05b0Hd\\u001aw\\u0007is8\\u001b6\ufffd=i\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226bbee49d1e6d26c5c52c7652996cd8a1c187251b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd\u0027C\u0027\ufffdr\\u001e\ufffd\ufffdJ\ufffd\ufffd\\t \\u001f\ufffdg\ufffd\ufffd\\u0014\\u0019\ufffd\ufffd\ufffd\\u0000D\ufffdf]|\u05b0Hd\\u001aw\\u0007is8\\u001b6\ufffd=i\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdW\ufffdUdL\ufffdiK\ufffd\ufffd\\\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd\u0027C\u0027\ufffdr\ufffd\ufffdJ\ufffd\ufffd\\t \ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffdf]|\u05b0Hdwis86\ufffd=i\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003W\ufffdUdL\ufffdiK\ufffd\ufffd\\\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd\u0027C\u0027\ufffdr\\u001e\ufffd\ufffdJ\ufffd\ufffd\\t \\u001f\ufffdg\ufffd\ufffd\\u0014\\u0019\ufffd\ufffd\ufffd\\u0000D\ufffdf]|\u05b0Hd\\u001aw\\u0007is8\\u001b6\ufffd=i\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdW\ufffdUdL\ufffdiK\ufffd\ufffd\\\\\ufffd\ufffdIfD\ufffd\ufffdh\ufffd\u0027C\u0027\ufffdr\ufffd\ufffdJ\ufffd\ufffd\\t \ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffdf]|\u05b0Hdwis86\ufffd=i\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":426},{"id":13563612,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51084,"dst_port":4443,"service":"pharos","classification":"pharos","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 426, \u0022payload_entropy\u0022: 6.048807811218793, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022740fde2f2ec32b2d4dde34ca34316163\u0022, \u0022path_pattern_hash\u0022: \u00228653057a4b57183ce71278ca80dbd82a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\\u0013\u0252\ufffd\ufffd:\ufffd\u016d\\u0016X\ufffd\ufffd\\\u0022G \\n!\ufffdS\ufffd\\u0015\ufffd\ufffd\ufffdt\ufffd\\u000fS\ufffd\ufffd\\f1S\\nI\ufffdI\\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\\u0013\u0252\ufffd\ufffd:\ufffd\u016d\\u0016X\ufffd\ufffd\\\u0022G \\n!\ufffdS\ufffd\\u0015\ufffd\ufffd\ufffdt\ufffd\\u000fS\ufffd\ufffd\\f1S\\nI\ufffdI\\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\\u0014\ufffd\/\ufffd\u0027\ufffd\\u0013\ufffd\\u0012\ufffd\\u0007\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\\t\ufffd\\b\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000k\\u00009\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000g\\u00003\\u0000\\u0016\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\\u0013\u0252\ufffd\ufffd:\ufffd\u016d\\u0016X\ufffd\ufffd\\\u0022G \\n!\ufffdS\ufffd\\u0015\ufffd\ufffd\ufffdt\ufffd\\u000fS\ufffd\ufffd\\f1S\\nI\ufffdI\\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229fcc2234ab5b6bd0a08f85f9737fa7d077af8b79\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\\u0013\u0252\ufffd\ufffd:\ufffd\u016d\\u0016X\ufffd\ufffd\\\u0022G \\n!\ufffdS\ufffd\\u0015\ufffd\ufffd\ufffdt\ufffd\\u000fS\ufffd\ufffd\\f1S\\nI\ufffdI\\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdYJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0252\ufffd\ufffd:\ufffd\u016dX\ufffd\ufffd\\\u0022G \\n!\ufffdS\ufffd\ufffd\ufffd\ufffdt\ufffdS\ufffd\ufffd1S\\nI\ufffdI\ufffdqj\u0634\ufffdv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003YJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\ufffdQ\ufffd\\u0013\u0252\ufffd\ufffd:\ufffd\u016d\\u0016X\ufffd\ufffd\\\u0022G \\n!\ufffdS\ufffd\\u0015\ufffd\ufffd\ufffdt\ufffd\\u000fS\ufffd\ufffd\\f1S\\nI\ufffdI\\u000f\ufffdqj\u0634\ufffdv\ufffd\ufffd\\u0000\ufffd\\u0000\\u0005\\u0000\\u0004\\u0000\\u0007\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000=\\u00005\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\u003C\\u0000\/\\u0000\\n\ufffd\\u0011\ufffd\\u0013\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\u0328\ufffdw\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdYJ\ufffd\ufffdlE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0252\ufffd\ufffd:\ufffd\u016dX\ufffd\ufffd\\\u0022G \\n!\ufffdS\ufffd\ufffd\ufffd\ufffdt\ufffdS\ufffd\ufffd1S\\nI\ufffdI\ufffdqj\u0634\ufffdv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\/\\n\ufffd\ufffd\u0328\ufffdw\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":426},{"id":13563614,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51096,"dst_port":4443,"service":"pharos","classification":"pharos","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 416, \u0022payload_entropy\u0022: 5.961164753142381, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c7b494d9fe2332b4ac22bf134fb15113\u0022, \u0022path_pattern_hash\u0022: \u00228653057a4b57183ce71278ca80dbd82a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd~\ufffd\\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\\u000f\ufffd%\u04a7\ufffd\\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\\u0011\\u001d\ufffdc\\n\ufffd=\\\u0022\ufffdi\ufffd\\u0005\\u0005\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd~\ufffd\\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\\u000f\ufffd%\u04a7\ufffd\\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\\u0011\\u001d\ufffdc\\n\ufffd=\\\u0022\ufffdi\ufffd\\u0005\\u0005\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd~\ufffd\\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\\u000f\ufffd%\u04a7\ufffd\\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\\u0011\\u001d\ufffdc\\n\ufffd=\\\u0022\ufffdi\ufffd\\u0005\\u0005\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002254140fe5ce1d39b5e1e87245d074ab675c4e4caf\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd~\ufffd\\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\\u000f\ufffd%\u04a7\ufffd\\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\\u0011\\u001d\ufffdc\\n\ufffd=\\\u0022\ufffdi\ufffd\\u0005\\u0005\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd~\ufffdbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\ufffd%\u04a7\ufffd\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\ufffdc\\n\ufffd=\\\u0022\ufffdi\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd~\ufffd\\u001cbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\\u000f\ufffd%\u04a7\ufffd\\u001a\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\\b\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\\u0011\\u001d\ufffdc\\n\ufffd=\\\u0022\ufffdi\ufffd\\u0005\\u0005\ufffd\ufffd\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd~\ufffdbE\ufffd\ufffd\ufffdgPD\ufffd\ufffd\ufffd\ufffd%\u04a7\ufffd\ufffd\ufffdH\/.C\u06ec\ufffd -\ufffd8]~\ufffd\ufffd\ufffdv`m\ufffd\ud8a4\udf88\ufffdc\\n\ufffd=\\\u0022\ufffdi\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":416},{"id":13563616,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51102,"dst_port":4443,"service":"pharos","classification":"pharos","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 439, \u0022payload_entropy\u0022: 5.975688004023673, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229039c89d9191db5d1358afc7953c909c\u0022, \u0022path_pattern_hash\u0022: \u00228653057a4b57183ce71278ca80dbd82a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017-\ufffdL\\u0015\ufffd9\\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\\u0001\\u001d\u0475\\\u0022\\u0018\ufffd\ufffd \ufffd\\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd\/\ufffd{\ufffd\\u0012\ufffdg\\u0019\u003E\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017-\ufffdL\\u0015\ufffd9\\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\\u0001\\u001d\u0475\\\u0022\\u0018\ufffd\ufffd \ufffd\\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd\/\ufffd{\ufffd\\u0012\ufffdg\\u0019\u003E\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\ufffd\\n\\u0013\\u0004\ufffd+\\u0013\\u0003\ufffd\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\\u0011\ufffd#\\u0000\\n\ufffd\\t\\u0000\/\ufffd\\b\\u0000\u003C\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u00005\\u0000E\\u0000=\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000k\\u0000A\\u00009\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\ufffd\ufffd\ufffd\\u0000\\u0007\\u0000g\\u0000\\u0004\\u00003\\u0000\\u0005\\u0000\\u0016\\u0001\\u0000\\u0000\ufffdjj\\u0000\\u0000\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017-\ufffdL\\u0015\ufffd9\\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\\u0001\\u001d\u0475\\\u0022\\u0018\ufffd\ufffd \ufffd\\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd\/\ufffd{\ufffd\\u0012\ufffdg\\u0019\u003E\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c815a2ee1eb92854c2e5076b5d7108264da6ce9a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017-\ufffdL\\u0015\ufffd9\\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\\u0001\\u001d\u0475\\\u0022\\u0018\ufffd\ufffd \ufffd\\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd\/\ufffd{\ufffd\\u0012\ufffdg\\u0019\u003E\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd-\ufffdL\ufffd9\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\u0475\\\u0022\ufffd\ufffd \ufffd\\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd\/\ufffd{\ufffd\ufffdg\u003E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\u0017-\ufffdL\\u0015\ufffd9\\u001e\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\\u0001\\u001d\u0475\\\u0022\\u0018\ufffd\ufffd \ufffd\\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd\/\ufffd{\ufffd\\u0012\ufffdg\\u0019\u003E\\u0000\ufffd\ufffd\ufffd\ufffd\\u0012\ufffd\\u0013\ufffd\\u0007\ufffd\u0027\ufffd\\u0014\ufffd\/\\u0013\\u0001\ufffd\\u0014\\u0013\\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\\u0013\\u0005\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd-\ufffdL\ufffd9\ufffd\u0744\ufffd\u076cX\ufffd\ube58y\ufffd\\t\ufffdo\ufffd\ufffd\ufffd \ufffd\u04e0I \ufffdN\ufffdRB\u0475\\\u0022\ufffd\ufffd \ufffd\\n\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd\/\ufffd{\ufffd\ufffdg\u003E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":439},{"id":13563617,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51116,"dst_port":4443,"service":"pharos","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 1503, \u0022payload_entropy\u0022: 7.703674844657129, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.57, \u0022classification_confidence\u0022: 0.57, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022832488a70179479dfef823497eb7f82b\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\\bO\\u0000\\u0010\\u0002\\u00138wb\ufffd\u003C\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\\u0015\ufffd\ufffd\ufffd_\\u0000\\u0015\\u001ai\ufffd\ufffd\\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\\u0003\\u0001\\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd#\ufffd\u0027\\u0000\u003C\ufffd\\u0007\ufffd\\u0011\\u0000\\u0005\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\\bO\\u0000\\u0010\\u0002\\u00138wb\ufffd\u003C\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\\u0015\ufffd\ufffd\ufffd_\\u0000\\u0015\\u001ai\ufffd\ufffd\\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\\u0003\\u0001\\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd#\ufffd\u0027\\u0000\u003C\ufffd\\u0007\ufffd\\u0011\\u0000\\u0005\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005[\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u0016\\u0000\\u0014\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\ufffd\ufffd\ufffd\ufffdJ\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\\bO\\u0000\\u0010\\u0002\\u00138wb\ufffd\u003C\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\\u0015\ufffd\ufffd\ufffd_\\u0000\\u0015\\u001ai\ufffd\ufffd\\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\\u0003\\u0001\\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd#\ufffd\u0027\\u0000\u003C\ufffd\\u0007\ufffd\\u0011\\u0000\\u0005\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002261eb55e3eb3b3aca71d87edc519414b2910e1e01\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\\bO\\u0000\\u0010\\u0002\\u00138wb\ufffd\u003C\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\\u0015\ufffd\ufffd\ufffd_\\u0000\\u0015\\u001ai\ufffd\ufffd\\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\\u0003\\u0001\\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd#\ufffd\u0027\\u0000\u003C\ufffd\\u0007\ufffd\\u0011\\u0000\\u0005\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffdO8wb\ufffd\u003C\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_i\ufffd\ufffd\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd\ufffd\ufffd\/5\ufffd\\n\ufffd#\ufffd\u0027\u003C\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 57, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffd\\bO\\u0000\\u0010\\u0002\\u00138wb\ufffd\u003C\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\\u0015\ufffd\ufffd\ufffd_\\u0000\\u0015\\u001ai\ufffd\ufffd\\u000f\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?\\u0003\\u0001\\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\ufffd\\u0012\\u0000\\n\ufffd#\ufffd\u0027\\u0000\u003C\ufffd\\u0007\ufffd\\u0011\\u0000\\u0005\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd\ufffdO8wb\ufffd\u003C\ufffdk\ufffd\ufffd~st\ufffd#\ufffd5\ufffdU \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd_i\ufffd\ufffd\ufffd\ufffd?\ufffd\u072a\ufffd\ufffdo3\ufffd$\ufffdl?2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd\ufffd\ufffd\/5\ufffd\\n\ufffd#\ufffd\u0027\u003C\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":1503},{"id":13563618,"ip":"209.97.138.155","ts":"2026-07-24 16:21:08.000000","proto":"tcp","src_port":51128,"dst_port":4443,"service":"pharos","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 1459, \u0022payload_entropy\u0022: 7.747144536494951, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.57, \u0022classification_confidence\u0022: 0.57, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227a12816b34a1b7044862c972b37e26cb\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdtd\\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\\u0017:\ufffda\ufffd\\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\\u001b\ufffd6\ufffdY\ufffd\ufffd\\u0006\ufffd\ufffd\u054bq\\u000b\\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\\u0018n\\u001f\ufffdP\\u001e\ufffd\\u0000\\u0006\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005[\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdtd\\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\\u0017:\ufffda\ufffd\\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\\u001b\ufffd6\ufffdY\ufffd\ufffd\\u0006\ufffd\ufffd\u054bq\\u000b\\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\\u0018n\\u001f\ufffdP\\u001e\ufffd\\u0000\\u0006\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005[\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u0016\\u0000\\u0014\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\u06eb|\\u0019\ufffdd\u003Ec\ufffdW+T.@|\\r ?\ufffd\\u0010\ufffd7zW\ufffd8\ufffdq\ufffdZ\ufffd\\u0018?*\\\\\ufffd{c@\\u0007\\b\\u0003\ufffd\ufffdf\ufffd\\u001c9\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdtd\\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\\u0017:\ufffda\ufffd\\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\\u001b\ufffd6\ufffdY\ufffd\ufffd\\u0006\ufffd\ufffd\u054bq\\u000b\\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\\u0018n\\u001f\ufffdP\\u001e\ufffd\\u0000\\u0006\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005[\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ce17b7c625c9ee6e747c514d1db6869db56336ca\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdtd\\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\\u0017:\ufffda\ufffd\\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\\u001b\ufffd6\ufffdY\ufffd\ufffd\\u0006\ufffd\ufffd\u054bq\\u000b\\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\\u0018n\\u001f\ufffdP\\u001e\ufffd\\u0000\\u0006\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005[\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdtd\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd:\ufffda\ufffdo\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\ufffd6\ufffdY\ufffd\ufffd\ufffd\ufffd\u054bqK\ufffd\ufffdq\ufffd\ufffd)\ufffdn\ufffdP\ufffd[\ufffd\\n\\n\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 57, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdtd\\u000f\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd\\u0017:\ufffda\ufffd\\u0005o\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\\u001b\ufffd6\ufffdY\ufffd\ufffd\\u0006\ufffd\ufffd\u054bq\\u000b\\u000fK\ufffd\ufffdq\ufffd\ufffd)\ufffd\\u0018n\\u001f\ufffdP\\u001e\ufffd\\u0000\\u0006\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005[\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdtd\ufffds\ufffd\ufffdx0k\ufffdO\ufffdX6\ufffd:\ufffda\ufffdo\ufffd8\ufffd\ufffd,\ufffd\ufffd \ufffdW\ufffd6\ufffdY\ufffd\ufffd\ufffd\ufffd\u054bqK\ufffd\ufffdq\ufffd\ufffd)\ufffdn\ufffdP\ufffd[\ufffd\\n\\n\ufffd\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":1459},{"id":13563604,"ip":"209.97.138.155","ts":"2026-07-24 16:21:07.000000","proto":"tcp","src_port":51020,"dst_port":4443,"service":"pharos","classification":"pharos","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 424, \u0022payload_entropy\u0022: 5.979770105871638, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022pharos\u0022, \u0022app_proto\u0022: \u0022pharos\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 4443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c69c7f867cbde1fc45845bf5a044a153ed44af02\u0022, \u0022event_fingerprint\u0022: \u002293264244ebf4f0b1c2a1e48e7422ea84be951ca8\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022117509bcba715ffb1cacec3c17ea499a\u0022, \u0022path_pattern_hash\u0022: \u00228653057a4b57183ce71278ca80dbd82a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\\u0018\\u001a\u003C6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\\r\ufffdK\ufffd\u91b3$Z\\u0015\ufffd\ufffd\ufffd\\u0001e}\ufffd\ufffd\ufffd\ufffdF\\\\+\\u001e\\u0006\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\\u0018\\u001a\u003C6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\\r\ufffdK\ufffd\u91b3$Z\\u0015\ufffd\ufffd\ufffd\\u0001e}\ufffd\ufffd\ufffd\ufffdF\\\\+\\u001e\\u0006\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\\u0018\\u001a\u003C6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\\r\ufffdK\ufffd\u91b3$Z\\u0015\ufffd\ufffd\ufffd\\u0001e}\ufffd\ufffd\ufffd\ufffdF\\\\+\\u001e\\u0006\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002204aee9191bbbc950ed96d69642648c7024cc7af2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\\u0018\\u001a\u003C6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\\r\ufffdK\ufffd\u91b3$Z\\u0015\ufffd\ufffd\ufffd\\u0001e}\ufffd\ufffd\ufffd\ufffdF\\\\+\\u001e\\u0006\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\u003C6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\\r\ufffdK\ufffd\u91b3$Z\ufffd\ufffd\ufffde}\ufffd\ufffd\ufffd\ufffdF\\\\+\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022, \u0022dst_port\u0022: 4443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\\u0018\\u001a\u003C6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\\r\ufffdK\ufffd\u91b3$Z\\u0015\ufffd\ufffd\ufffd\\u0001e}\ufffd\ufffd\ufffd\ufffdF\\\\+\\u001e\\u0006\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022port\u0022: 4443, \u0022service\u0022: \u0022pharos\u0022, \u0022service_label_fr\u0022: \u0022PHAROS\u0022}, \u0022attack_vector\u0022: \u0022pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdM\ufffd\ufffdcM\ufffd\u003C6\ufffd\ufffd\ufffdUE\ufffd+d\u059f H\ufffd39%\ufffd\ufffd\\r\ufffdK\ufffd\u91b3$Z\ufffd\ufffd\ufffde}\ufffd\ufffd\ufffd\ufffdF\\\\+\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00224443 \u00b7 PHAROS\u0022, \u0022emulator_service\u0022: \u0022pharos\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022pharos\u0022, \u0022service_banner\u0022: \u0022honeypot-pharos\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":424},{"id":13563605,"ip":"209.97.138.155","ts":"2026-07-24 16:21:07.000000","proto":"tcp","src_port":58712,"dst_port":8080,"service":"http","classification":"stun_probe","waf_score":0,"waf_tags":"[]","http_method":"\u0016\u0003\u0003\u0001\u0001\u0000\u0001\u0003\u0003tu_]\u0010\u0017","http_target":"-hv4-","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022858555a88e5b068d0dde4e1349d4ee2ff3c28238\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003tu_]\\u0010\\u0017\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 424, \u0022payload_entropy\u0022: 5.976736007988104, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14061, \u0022country\u0022: \u0022GB\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022419e4ac29452b92a185dedfa84ffda7030a25df9\u0022, \u0022event_fingerprint\u0022: \u0022e674a36cd19c443097e00238452553703c83c5aa\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%\u0022, \u0022confidence\u0022: 0.52, \u0022classification_confidence\u0022: 0.52, \u0022precision_score\u0022: 52, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0771\u0022], \u0022matched_patterns\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 44.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022GB\u0022, \u0022asn\u0022: 14061, \u0022org\u0022: \u0022DigitalOcean, LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225cd19bf29227c9ef5f47de0704388518\u0022, \u0022path_pattern_hash\u0022: \u0022ea5e3b9f8c39750094408f2b7293d1b2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022method\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003tu_]\\u0010\\u0017\u0022, \u0022path\u0022: \u0022-hv4-\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003TU_]\\u0010\\u0017 -hv4- HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\\u0010\\u0017\ufffd\\u001f\ufffd\ufffd\\f\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k\\u0015-C\ufffdW\ufffd\\u001f\u06edA\ufffdO\\b\\u001ap.!\ufffdW%\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003tu_]\\u0010\\u0017\u0022, \u0022path\u0022: \u0022-hv4-\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003TU_]\\u0010\\u0017 -hv4- HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\\u0010\\u0017\ufffd\\u001f\ufffd\ufffd\\f\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k\\u0015-C\ufffdW\ufffd\\u001f\u06edA\ufffdO\\b\\u001ap.!\ufffdW%\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\\u0013\\u0002\\u0013\\u0001\ufffd\\u0014\ufffd\\u0007\ufffd\\u0012\ufffd\\u0013\ufffd\u0027\ufffd\/\ufffd\\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\\u0013\\u0005\\u0013\\u0004\\u0013\\u0003\ufffd\\u0013\ufffd\\u0011\\u0000\\n\\u0000\/\\u0000\u003C\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00005\\u0000=\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\\u0007\\u0000\\u0004\\u0000\\u0005\\u0001\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u0017\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\\u0010\\u0017\ufffd\\u001f\ufffd\ufffd\\f\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k\\u0015-C\ufffdW\ufffd\\u001f\u06edA\ufffdO\\b\\u001ap.!\ufffdW%\\u0000\ufffd\\u0000\\u0016\\u00003\\u0000g\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u00009\\u0000k\ufffd\ufffd\ufffd\ufffd\\u0000\ufffd\\u0000E\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\ufffd\\b\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002294f7bbd8c3c5d18c16070d9518c42b90ff1d21ee\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003tu_]\\u0010\\u0017\u0022, \u0022http_path\u0022: \u0022-hv4-\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003TU_]\\u0010\\u0017 -hv4- HTTP\/1.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k-C\ufffdW\ufffd\u06edA\ufffdOp.!\ufffdW%\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022stun probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 -hv4-\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 44 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab stun_probe \u00bb (signaux protocolaires) \u00b7 confiance 44%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 52, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003tu_]\\u0010\\u0017\u0022, \u0022http_path\u0022: \u0022-hv4-\u0022, \u0022request_line\u0022: \u0022\\u0016\\u0003\\u0003\\u0001\\u0001\\u0000\\u0001\\u0003\\u0003TU_]\\u0010\\u0017 -hv4- HTTP\/1.1\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022stun probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 -hv4-\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdt\ufffdu\ufffd\ufffd\ufffd_\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdh\ufffd\ufffdv\ufffd4- lO\u05a4\ufffd|\ufffd(\ufffd k-C\ufffdW\ufffd\u06edA\ufffdOp.!\ufffdW%\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\\n\ufffd$\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 44 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 52 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022pharos\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_no_ua\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"lO\u05a4|(","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":424}],"total_events":15}