217.60.78.66

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3954,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "acaa06689b562cec32be87e1c3b89ac6bba0aa5b",
    "event_fingerprint": "f4284319794a43b6cb1f4dd86e077ba194a1355f",
    "classification_reason": "Type \u00ab port_3954_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "d96eea30db51d887467fd38ee3b4fdb8"
    },
    "target_context": {
        "dst_port": 3954,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3954_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1b61c29664c85df996bb2c9939c30074a7b343f3",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3954
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3954 tcp \u00b7 port 3954 \u00b7 (sonde \/ probe)",
    "target_port_label": "3954",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3954_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3954_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3954,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3954
        },
        "attack_vector": "port 3954 tcp \u00b7 port 3954 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3954",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3954"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3874,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "9be8dfe5f206dc404ddb0716b9df5ea789776f4b",
    "event_fingerprint": "fe96cd6db88aa1a6f52d07405965cf748718789a",
    "classification_reason": "Type \u00ab port_3874_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "e4bbc9fc165997658e41d684d964dc53"
    },
    "target_context": {
        "dst_port": 3874,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3874_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "08c4b3c7269a743897b0697fd6e26198b9035edc",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3874
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3874 tcp \u00b7 port 3874 \u00b7 (sonde \/ probe)",
    "target_port_label": "3874",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3874_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3874_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3874,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3874
        },
        "attack_vector": "port 3874 tcp \u00b7 port 3874 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3874",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3874"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3921,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1672b0a596cefb53e2eb727b4466c6a8572a3656",
    "event_fingerprint": "ef4150ca5cda5270e742c197750554a3f4508856",
    "classification_reason": "Type \u00ab port_3921_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "ae04d4c9cbb30a2fd075250590895e25"
    },
    "target_context": {
        "dst_port": 3921,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3921_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "80cf612fafd3241091bf507e2d7ce0c7cc92a4a0",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3921
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3921 tcp \u00b7 port 3921 \u00b7 (sonde \/ probe)",
    "target_port_label": "3921",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3921_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3921_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3921,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3921
        },
        "attack_vector": "port 3921 tcp \u00b7 port 3921 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3921",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3921"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3939,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "d344cb975a27110d9d7c05b5c2262ff961b00414",
    "event_fingerprint": "6da14e30f7a035dcd443425f2a55a7fa5c917724",
    "classification_reason": "Type \u00ab port_3939_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "da32a940494104fe3f36efb39001ea74"
    },
    "target_context": {
        "dst_port": 3939,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3939_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fbdc5bec6d25790c6c0be570c1579650f0d6cb5d",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3939
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3939 tcp \u00b7 port 3939 \u00b7 (sonde \/ probe)",
    "target_port_label": "3939",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3939_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3939_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3939,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3939
        },
        "attack_vector": "port 3939 tcp \u00b7 port 3939 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3939",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3939"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3929,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f345ad0c8f7feecdeaff8ad3f67050ef57bfdbce",
    "event_fingerprint": "e2c924c633496142e46fc40fc66c5b88927a0e4f",
    "classification_reason": "Type \u00ab port_3929_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "d1c623a9e3b2d625ac3823165479a7b4"
    },
    "target_context": {
        "dst_port": 3929,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3929_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6998f7949514610f31827bc74752549f12a4f4bf",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3929
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3929 tcp \u00b7 port 3929 \u00b7 (sonde \/ probe)",
    "target_port_label": "3929",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3929_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3929_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3929,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3929
        },
        "attack_vector": "port 3929 tcp \u00b7 port 3929 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3929",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3929"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3801,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "62e81082927e3b128f69f23031efdf1ed75e14be",
    "event_fingerprint": "3a239e7c86eff0c3510c0e8a70f8a26b2c6c74eb",
    "classification_reason": "Type \u00ab port_3801_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "b7c509012e86efea21607c137bdc1554"
    },
    "target_context": {
        "dst_port": 3801,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3801_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "41de17ee57896dee51b5318419bd929bfb4d67b9",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3801
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3801 tcp \u00b7 port 3801 \u00b7 (sonde \/ probe)",
    "target_port_label": "3801",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3801_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3801_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3801,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3801
        },
        "attack_vector": "port 3801 tcp \u00b7 port 3801 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3801",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3801"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3813,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "c192a90dcf924aa2f17cd0ac46befe566fec3b7d",
    "event_fingerprint": "42df7725593b7ae4408a6d4c452196bbf480480b",
    "classification_reason": "Type \u00ab port_3813_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "5df07cf9fd8f20267adf59ad8e086d42"
    },
    "target_context": {
        "dst_port": 3813,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3813_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8ea57846f678da1c47baf66906dcff60f58e7b85",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3813
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3813 tcp \u00b7 port 3813 \u00b7 (sonde \/ probe)",
    "target_port_label": "3813",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3813_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3813_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3813,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3813
        },
        "attack_vector": "port 3813 tcp \u00b7 port 3813 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3813",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3813"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3905,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "558f69b8ee7e1813b77c6d2a377007dc90fdd563",
    "event_fingerprint": "c5ce35a8abc46de9134101c51e4091826d27cc03",
    "classification_reason": "Type \u00ab port_3905_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "c9652d96e1dfde050b8c7dc142a89b6f"
    },
    "target_context": {
        "dst_port": 3905,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3905_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ba987180a3f14a173de49e0733d714dfa8fc5bb7",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3905
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3905 tcp \u00b7 port 3905 \u00b7 (sonde \/ probe)",
    "target_port_label": "3905",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3905_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3905_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3905,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3905
        },
        "attack_vector": "port 3905 tcp \u00b7 port 3905 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3905",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3905"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3957,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "0b3d9589e6e76de70e52ffd04716c06313576d3a",
    "event_fingerprint": "35aed8734266a62927ce99fd662ae69006c67f40",
    "classification_reason": "Type \u00ab port_3957_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "45c029deb6fffdd9e2111ffa51730da7"
    },
    "target_context": {
        "dst_port": 3957,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3957_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b3c3b25995764358590d758e8586217543f0a459",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3957
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3957 tcp \u00b7 port 3957 \u00b7 (sonde \/ probe)",
    "target_port_label": "3957",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3957_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3957_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3957,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3957
        },
        "attack_vector": "port 3957 tcp \u00b7 port 3957 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3957",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3957"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3812,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3cbbc2cd49e925fc0d7e6718525fdfad8581a001",
    "event_fingerprint": "cc7c2f43d2d1cc44664c4bcecdea8b0e545046e8",
    "classification_reason": "Type \u00ab port_3812_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "85482ab138978f23dc1c250e22ee58df"
    },
    "target_context": {
        "dst_port": 3812,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3812_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1d8857239b2e5d53756e832743cb6f42bf246d60",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3812
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3812 tcp \u00b7 port 3812 \u00b7 (sonde \/ probe)",
    "target_port_label": "3812",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3812_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3812_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3812,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3812
        },
        "attack_vector": "port 3812 tcp \u00b7 port 3812 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3812",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3812"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3932,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "83defe112fbf270b1e468d1433c0fca7a6a4585b",
    "event_fingerprint": "fcaa89227c9f4118ce4b849e60e5a385bfd63037",
    "classification_reason": "Type \u00ab port_3932_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "5a6fed208dc68a6de9daa9001be3f79c"
    },
    "target_context": {
        "dst_port": 3932,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3932_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f97a8c62e37174ea1959d98c2c9b972561d77eef",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3932
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3932 tcp \u00b7 port 3932 \u00b7 (sonde \/ probe)",
    "target_port_label": "3932",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3932_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3932_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3932,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3932
        },
        "attack_vector": "port 3932 tcp \u00b7 port 3932 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3932",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3932"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3991,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "d51954749a4f86653727fe5ae4f062f75c97ec70",
    "event_fingerprint": "6fa606c21bee737d7cbbcd82ba6ae346ec32b4ca",
    "classification_reason": "Type \u00ab port_3991_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "65964ef94208c9283ec007746a404fd0"
    },
    "target_context": {
        "dst_port": 3991,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3991_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a694ecfe8af4c718e65abe14727e72a086434a87",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3991
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3991 tcp \u00b7 port 3991 \u00b7 (sonde \/ probe)",
    "target_port_label": "3991",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3991_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3991_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3991,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3991
        },
        "attack_vector": "port 3991 tcp \u00b7 port 3991 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3991",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3991"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3893,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5b04583811eed5296284d79cb8cee85beb19f303",
    "event_fingerprint": "89015af1f90a7286e5a230b0786fed823a47514a",
    "classification_reason": "Type \u00ab port_3893_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "6f2be1bb530dc2c36e5cff29f828a421"
    },
    "target_context": {
        "dst_port": 3893,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3893_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1814e837b7ad7f841414ba8ea0af70eab1824f67",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3893
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3893 tcp \u00b7 port 3893 \u00b7 (sonde \/ probe)",
    "target_port_label": "3893",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3893_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3893_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3893,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3893
        },
        "attack_vector": "port 3893 tcp \u00b7 port 3893 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3893",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3893"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3987,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e7482ee49a00c653bb167f6dc911378b79735787",
    "event_fingerprint": "cf636ea06e6eb11a64a2ee57e234521bfcfa474a",
    "classification_reason": "Type \u00ab port_3987_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "bfa1a003da2a77574d0244ea7875a38a"
    },
    "target_context": {
        "dst_port": 3987,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3987_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "056f3d1f5a6b338aaf310ea762c5725872c6d103",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3987
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3987 tcp \u00b7 port 3987 \u00b7 (sonde \/ probe)",
    "target_port_label": "3987",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3987_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3987_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3987,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3987
        },
        "attack_vector": "port 3987 tcp \u00b7 port 3987 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3987",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3987"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3906,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "cf5f8296a200674b7d452c9911f945a0a0e325c2",
    "event_fingerprint": "594a1b72fb6519593c40f9abe886b9b0a03ec319",
    "classification_reason": "Type \u00ab port_3906_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "e216e3bb753429908ba1557f2b9573f9"
    },
    "target_context": {
        "dst_port": 3906,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3906_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "66461d3cfb28e440b32039830fce64f848c05fe4",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3906
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3906 tcp \u00b7 port 3906 \u00b7 (sonde \/ probe)",
    "target_port_label": "3906",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3906_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3906_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3906,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3906
        },
        "attack_vector": "port 3906 tcp \u00b7 port 3906 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3906",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3906"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3832,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bee1bcfba9318cf462126d3d86fd34857d71b562",
    "event_fingerprint": "ecb183bd0e0662cae7ad045956f41d31f4388b1f",
    "classification_reason": "Type \u00ab port_3832_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "feafa847df3f314eb74fe0ada7ab3a3d"
    },
    "target_context": {
        "dst_port": 3832,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3832_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d4179baead49bba2c607343aef9bab7b6415c08c",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3832
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3832 tcp \u00b7 port 3832 \u00b7 (sonde \/ probe)",
    "target_port_label": "3832",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3832_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3832_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3832,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3832
        },
        "attack_vector": "port 3832 tcp \u00b7 port 3832 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3832",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3832"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3916,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "05114e90a3b31d0305e0c0afa9ea54ff0a4a798b",
    "event_fingerprint": "8c6832d04e8c8e565b27cc517194fd149ef87a7a",
    "classification_reason": "Type \u00ab port_3916_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "e60efe0906b545aa872622d58d11d2ae"
    },
    "target_context": {
        "dst_port": 3916,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3916_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "84941ccefb2a33900ba5f8f2df09dcc6449abe55",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3916
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3916 tcp \u00b7 port 3916 \u00b7 (sonde \/ probe)",
    "target_port_label": "3916",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3916_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3916_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3916,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3916
        },
        "attack_vector": "port 3916 tcp \u00b7 port 3916 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3916",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3916"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 19,
    "payload_entropy": 1.8784775129881184,
    "port_category": "registered",
    "org": "Throttle Limited",
    "service": null,
    "app_proto": null,
    "asn": 198189,
    "country": "AE",
    "dst_port": 3802,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "6cf36d11199dd51f93326d2c7dfe5b0dbcabe5b7",
    "event_fingerprint": "c26ccdf09f1b3d652006a5553929c7e3f58227aa",
    "classification_reason": "Type \u00ab port_3802_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "AE",
        "asn": 198189,
        "org": "Throttle Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c7fc4bd4bc65329ae66eeb0073ae405e",
        "path_pattern_hash": "31e6981ad085a049189186477b7daef9"
    },
    "target_context": {
        "dst_port": 3802,
        "risk_score": 35
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3802_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "856409b8bb3ec5b8faa19d8c29bed6ca88039f45",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3802
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port 3802 tcp \u00b7 port 3802 \u00b7 (sonde \/ probe)",
    "target_port_label": "3802",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3802_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab port_3802_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3802,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0348"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3802
        },
        "attack_vector": "port 3802 tcp \u00b7 port 3802 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3802",
        "emulator_service": null,
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3802"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}