30/10/2026 12:11:12 UTC
TCP
9200 · ELASTICSEARCH
Scanner web
web scanner · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices
Élevée
Moyen · 54
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
Découverte
Accès
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices UA Hello from Palo Alto Networks, find out more about our scans in…
Émulateur
ELASTICSEARCH
WAF
30
Recommandation
Investiguer
Tags
950318:lfi-14
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 5 tag(s) WAF
Protocole émulé
1 Signaux
Scanner Palo Alto
Upstream
Waf Score
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET /_cat/indices HTTP/1.1
User-Agent
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity
Règles WAF
lfi-14
ssrf-3
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Hello from Palo Alto Networks, find out more about our scans in h
Requête brute (extrait)
GET /_cat/indices HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"http_header_count":2,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"689bfbab10519e1ecf247982c128c7460ee59d4d","http_host_hash":"d19a1b8472adabca1ee6e310101ca46b45ece34e","http_target_hash":"eb975ea7c062f39e92ee97d6604bbf2a22d462ed","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":207,"payload_entropy":5.0712595801878475,"port_category":"registered","org":"Google LLC","service":"elasticsearch","app_proto":"elasticsearch","asn":396982,"country":"US","dst_port":9200,"risk_waf":75,"risk_classification":42,"risk_behavior":0,"risk_geo":40,"risk_protocol":50,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.6,"risk_breakdown":{"waf":75,"classification":42,"behavior":0,"geo":40,"protocol":50,"novelty":25},"risk_score":54,"tag_count":8,"anomaly_count":0,"campaign_key":"0eb6e2a516f8dff7a9bb533994d6fd0b0e0d1485","event_fingerprint":"8589cdab407754f0d5ac994640bd6e3f49996396","classification_reason":"User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":147,"precision_signals":["INT-scanner-…
29/10/2026 21:09:34 UTC
TCP
7547 · HTTP
SSRF
ssrf attack · via HTTP:7547 · (tentative d'exploit)
Élevée
Critique · 86
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1090
Accès
Exécution
Protocole
POST /
Émulateur
HTTP
WAF
29
Recommandation
Bloquer (recommandé)
Tags
950079:sqli-19
950327:rce-0
950407:ssrf-3
950471:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7547
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · Motif SSRF · confiance 100%
Confiance classification
100%
Risque capteur
Critique
· 86
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Ssrf
Upstream
Waf Score
Tactiques MITRE
Accès initial
Exécution
Ligne de requête
POST / HTTP/1.1
User-Agent
—
Règles WAF
sqli-19
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Content-Type: application/xml
Host: 62.3.50.33:7547
Content-Length: 639
<?xml version="1.0" encoding="UTF-
Requête brute (extrait)
POST / HTTP/1.1 Content-Type: application/xml Host: 62.3.50.33:7547 Content-Length: 639 <?xml version="1.0" encoding="UTF-8" standalone="no"?> <soap_env:Envelope xmlns:soap_env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap_enc="http://schema
Meta JSON brut
{"http_header_count":3,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":"89d87453121897c0b4544fa397f8c826335c2714","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":734,"payload_entropy":5.445567143109139,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"US","dst_port":7547,"risk_waf":100,"risk_classification":84,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":25,"risk_boost":15,"risk_granularity":5.2,"risk_breakdown":{"waf":100,"classification":84,"behavior":0,"geo":40,"protocol":35,"novelty":25},"risk_score":86,"tag_count":10,"anomaly_count":0,"campaign_key":"5c27582938038c07d7e0eb0ca126b831a7cb2961","event_fingerprint":"066608c9ffe4e19b8a5f62c5c4e6e70f82a78933","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Motif SSRF \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":110,"precision_signals":["INT-http_ssrf","INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-http_ssrf","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":100,"classification":84,"behavior":0,"geo":40,"protocol":35,"novelty":25,"risk_score":86},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"U…
28/10/2026 19:31:39 UTC
TCP
9001 · TOR OR
Sonde nœud de sortie Tor
tor exit probe · via TOR OR:9001 · (commande & contrôle)
Élevée
Faible · 35
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
Commande
Protocole
Émulateur
TOR-OR
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mongodb_hello_probe
net_tor_probe
tor_exit_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9001
Chemin / cible
—
Service
TOR OR
Payload
GET / HTTP/1.1 Host: 62.3.50.33:9001 User-Agent: Hello from Palo Alto Networks, find out more about our scans in https://docs-
Pourquoi cette classification : Type « Sonde nœud de sortie Tor » (signaux protocolaires) · confiance 46%
Confiance classification
46%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 46 % — 6 signal(aux) capteur
Protocole émulé
1 Signaux
Tor Exit Hint
Technique MITRE
TA0011
Tactiques MITRE
Commande & contrôle
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9001
User-Agent: Hello from Palo Alto Networks, find out more about our scans in https://docs-
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9001 User-Agent: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity Accept-Encoding: gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"030000000000000000","emulator_response_len":9,"bytes_in":218,"payload_entropy":5.094935618782794,"port_category":"registered","org":"Google LLC","service":"tor-or","app_proto":"tor-or","asn":396982,"country":"US","dst_port":9001,"risk_waf":8,"risk_classification":62,"risk_behavior":0,"risk_geo":40,"risk_protocol":40,"risk_novelty":25,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":8,"classification":62,"behavior":0,"geo":40,"protocol":40,"novelty":25},"risk_score":35,"tag_count":6,"anomaly_count":0,"campaign_key":"55edd297bcbd48ce5642ac95ea8c6e1b14effd32","event_fingerprint":"2bc74a66a243c40126697f519e65200a159d147e","classification_reason":"Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%","confidence":0.46,"classification_confidence":0.46,"precision_score":55,"precision_signals":["INT-TOR-exit-hint"],"kb_rule_ids":["INT-TOR-exit-hint"],"confidence_breakdown":{"waf":8,"classification":62,"behavior":0,"geo":40,"protocol":40,"novelty":25,"risk_score":35},"named_classification_skipped":false,"service_name":"tor-or","risk_confidence_factor":46,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":396982,"org":"Google LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"payload_hash":"bfd45844cde66ce8fdc7015ada6620ee","path_pattern_hash":"d2d40d620e587c49ef0af866b893b1d5"},"target_context":{"dst_port":9001,"service":"tor-or","service_name":"tor-or","risk…