{"ip":"31.184.195.244","exported_at":"2026-10-24T03:51:41+00:00","period_days":30,"metrics":{"events7d":25,"distinct_ports":20,"distinct_classifications":17,"max_severity":8,"last_sensor_id":"paris-1","max_waf_score":16,"max_risk_score":48,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["scanner","IP signal\u00e9e (IPsum, 3 listes ou plus)","IP malveillante (CINS Army)"],"recommended_action":"monitor","confidence":0.74,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":16,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 40\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":40},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":74,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":[],"tags_summary":[],"attack_vector":"Sonde HTTP \u00b7 via NODE HTTP:3000 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\u0022\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\u0000(\ufffd\n\ufffd\u0014\u00009\u0000k\u00005\u0000=\ufffd\u0007\ufffd\t\ufffd#\ufffd\u0011\ufffd\u0013\ufffd\u0027\u00003\u0000g\u00002\u0000\u0005\u0000\u0004\u0000\/\u0000\u003C\u0000\n\u0001\u0000\u0000\ufffd\ufffd\u0000\u0000\u001a\u0000\u0018","port":3000,"service":"node-http","service_label_fr":"NODE HTTP"},"protocol_summary_fr":"Payload \u0016\u0003\u0002\u0001o\u0001\u0000\u0001k\u0003\u0002RH\ufffd\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\u0013\ufffd\ufffd\u001c=\u0022\ufffd\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u2026 \u00b7 NODE HTTP:3000","evidence_snippet":"okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\n\ufffd9k5=\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\n\ufffd\ufffd","target_port_label":"3000 \u00b7 NODE HTTP","emulator_service":"node-http","confidence_reason":"Confiance 74 % \u2014 Score WAF 8","classification_reason":"Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%","classification_reason_label_fr":"Type \u00ab Sonde HTTP \u00bb (signaux protocolaires) \u00b7 confiance 74%","confidence_factors_fr":"Confiance 74 % \u2014 Score WAF 8","payload_preview":"okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\n\ufffd9k5=\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\n\ufffd\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":true,"label_fr":"IP signal\u00e9e (IPsum, 3 listes ou plus)","detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":true,"label_fr":"IP malveillante (CINS Army)","detail_fr":null}},"dnsbl":{"query":"244.195.184.31.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":7462351,"ip":"31.184.195.244","ts":"2026-10-24 03:35:41.000000","proto":"tcp","src_port":60023,"dst_port":3000,"service":"node-http","classification":"web_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f\u0022, \u0022emulator_response_len\u0022: 106, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022node-http\u0022, \u0022app_proto\u0022: \u0022node-http\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022774f10c7fed7e921b4e0aee88480d07ed8c2210a\u0022, \u0022event_fingerprint\u0022: \u002234fd482cd7628741af06d058b16059cafd546c90\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u00224154520a4208b3f021f35a6cc1dd98ae\u0022}, \u0022service_name\u0022: \u0022node-http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 3000, \u0022service\u0022: \u0022node-http\u0022, \u0022service_name\u0022: \u0022node-http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.74, \u0022classification_confidence\u0022: 0.74, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022122d9768a4135cf0e7ea305512178b236f36c651\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 3000, \u0022service\u0022: \u0022node-http\u0022, \u0022service_label_fr\u0022: \u0022NODE HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via NODE HTTP:3000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223000 \u00b7 NODE HTTP\u0022, \u0022emulator_service\u0022: \u0022node-http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 74, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022node-http\u0022, \u0022service_label_fr\u0022: \u0022NODE HTTP\u0022, \u0022dst_port\u0022: 3000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-node-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 3000, \u0022service\u0022: \u0022node-http\u0022, \u0022service_label_fr\u0022: \u0022NODE HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via NODE HTTP:3000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223000 \u00b7 NODE HTTP\u0022, \u0022emulator_service\u0022: \u0022node-http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 74 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022node_http\u0022, \u0022service_banner\u0022: \u0022honeypot-node-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_web_probe\u0022, \u0022node_http_emulated\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_web_probe\u0022, \u0022node_http_emulated\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":372},{"id":7432688,"ip":"31.184.195.244","ts":"2026-10-24 02:11:51.000000","proto":"tcp","src_port":60021,"dst_port":1080,"service":"socks5","classification":"socks5_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022socks5\u0022, \u0022app_proto\u0022: \u0022socks5\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 1080, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 50.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c4456c11bb207fc83a21f6a530e37cb56baf9f93\u0022, \u0022event_fingerprint\u0022: \u00223331cd638f7f2882b3f28f93273086620fcbe7b5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022socks5\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u0022bfccf9f2989c411a7f395b1e4889bbc9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1080, \u0022service\u0022: \u0022socks5\u0022, \u0022service_name\u0022: \u0022socks5\u0022, \u0022risk_score\u0022: 34}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022network_service_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223ab8b973f9c4ca3cb4437ef10fecc7fd073c6770\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 1080, \u0022service\u0022: \u0022socks5\u0022, \u0022service_label_fr\u0022: \u0022SOCKS5\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221080 \u00b7 SOCKS5\u0022, \u0022emulator_service\u0022: \u0022socks5\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 50.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022socks5\u0022, \u0022service_label_fr\u0022: \u0022SOCKS5\u0022, \u0022dst_port\u0022: 1080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-socks5\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 1080, \u0022service\u0022: \u0022socks5\u0022, \u0022service_label_fr\u0022: \u0022SOCKS5\u0022}, \u0022attack_vector\u0022: \u0022socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00221080 \u00b7 SOCKS5\u0022, \u0022emulator_service\u0022: \u0022socks5\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022socks5\u0022, \u0022service_banner\u0022: \u0022honeypot-socks5\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_socks5_probe\u0022, \u0022socks5_emulated\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_socks5_probe\u0022, \u0022socks5_emulated\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":372},{"id":7401947,"ip":"31.184.195.244","ts":"2026-10-24 00:50:56.000000","proto":"tcp","src_port":60021,"dst_port":6650,"service":"http","classification":"exploit_attempt","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022a5d1fb4038518fe0ebb1893e348c7b185e0551c5\u0022, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.1701635970999265, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 6650, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 46, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022688d9a01f9504f1a1dfdcd08de9a25e74f502f40\u0022, \u0022event_fingerprint\u0022: \u002207616ad3d60e3127c6386b0efd557f88373691cf\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.62, \u0022classification_confidence\u0022: 0.62, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00224265e407fd374471485c2088155c8a8d\u0022, \u0022payload_hash\u0022: \u0022618d57d87dabc9d6936ad0df561ec07f\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6650, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 46}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\\r\\n\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225bf53ac7583cb2a51487b5209b26572df1474a88\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\u0022, \u0022port\u0022: 6650, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:6650 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00226650 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 62, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 46, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6650, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\u0022, \u0022port\u0022: 6650, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:6650 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022target_port_label\u0022: \u00226650 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226650\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":"Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":8,"bytes_in":129},{"id":7366409,"ip":"31.184.195.244","ts":"2026-10-23 23:11:29.000000","proto":"tcp","src_port":60021,"dst_port":23,"service":"telnet","classification":"port_23_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20\u0022, \u0022emulator_response_len\u0022: 45, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022telnet\u0022, \u0022app_proto\u0022: \u0022telnet\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 23, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b927491f312d0fe43bbc12f39f34bf48ee2ef3f1\u0022, \u0022event_fingerprint\u0022: \u002279b983d64b1c5573cc70fb9163374500a6810d67\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022telnet_probe\u0022, \u0022service_name\u0022: \u0022telnet\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u00222bb94c377622e6c9a2e704e9148568af\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 23, \u0022service\u0022: \u0022telnet\u0022, \u0022service_name\u0022: \u0022telnet\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022db42c1bfe796e77020a014e1437b3df204699adf\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 23, \u0022service\u0022: \u0022telnet\u0022, \u0022service_label_fr\u0022: \u0022Telnet\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002223 \u00b7 Telnet\u0022, \u0022emulator_service\u0022: \u0022telnet\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022telnet\u0022, \u0022service_label_fr\u0022: \u0022Telnet\u0022, \u0022dst_port\u0022: 23, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-telnet\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 23, \u0022service\u0022: \u0022telnet\u0022, \u0022service_label_fr\u0022: \u0022Telnet\u0022}, \u0022attack_vector\u0022: \u0022port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002223 \u00b7 Telnet\u0022, \u0022emulator_service\u0022: \u0022telnet\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022telnet\u0022, \u0022service_banner\u0022: \u0022honeypot-telnet\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002223\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_telnet_probe\u0022, \u0022telnet_emulated\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_telnet_probe\u0022, \u0022telnet_emulated\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":372},{"id":7350670,"ip":"31.184.195.244","ts":"2026-10-23 22:24:43.000000","proto":"tcp","src_port":60021,"dst_port":8443,"service":"https","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 129, \u0022payload_entropy\u0022: 5.1701635970999265, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222aa17a6b515596b20eaea8d57184d62da9f48dfc\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022618d57d87dabc9d6936ad0df561ec07f\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\\r\\n\\r\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227721d3b93f6adf8452aa328714ca9d0b6b23280d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (X11; U; Linux armv61; en-US; rv:1.9.1b2pre) Gecko\/20081015 Fennec\/1.0a1\\r\\nAccept: *\/*\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":129},{"id":7326226,"ip":"31.184.195.244","ts":"2026-10-23 21:13:35.000000","proto":"tcp","src_port":60023,"dst_port":9200,"service":"elasticsearch","classification":"exploit_attempt","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c\u0022, \u0022emulator_response_len\u0022: 172, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002210c7d11f054a12ae8945af70fbb50a32e0bad203\u0022, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 168, \u0022payload_entropy\u0022: 5.427683126357951, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022elasticsearch\u0022, \u0022app_proto\u0022: \u0022elasticsearch\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 9200, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 48, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221588160a3e3161f8047fceed07bc1754ee5a47dd\u0022, \u0022event_fingerprint\u0022: \u00229fad56c821c1c5ddd2cc50fc2ca67d9c1727e39e\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.62, \u0022classification_confidence\u0022: 0.62, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022elasticsearch\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002239e0dd9d584c5010821187c92a01be60\u0022, \u0022payload_hash\u0022: \u002292dcf26fbe465d00bf320f6ec91f598c\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9200, \u0022service\u0022: \u0022elasticsearch\u0022, \u0022service_name\u0022: \u0022elasticsearch\u0022, \u0022risk_score\u0022: 48}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225862f6275442ef94ce18893f12850ce22f1a83c9\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/53\u2026\u0022, \u0022elasticsearch_probe_fr\u0022: \u0022Requ\u00eate Elasticsearch : \/\u0022, \u0022port\u0022: 9200, \u0022service\u0022: \u0022elasticsearch\u0022, \u0022service_label_fr\u0022: \u0022ELASTICSEARCH\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via ELASTICSEARCH:9200 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00229200 \u00b7 ELASTICSEARCH\u0022, \u0022emulator_service\u0022: \u0022elasticsearch\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via ELASTICSEARCH\u0022, \u0022confidence_pct\u0022: 62, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 48, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022elasticsearch\u0022, \u0022service_label_fr\u0022: \u0022ELASTICSEARCH\u0022, \u0022dst_port\u0022: 9200, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Elasticsearch 8.11\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/53\u2026\u0022, \u0022elasticsearch_probe_fr\u0022: \u0022Requ\u00eate Elasticsearch : \/\u0022, \u0022port\u0022: 9200, \u0022service\u0022: \u0022elasticsearch\u0022, \u0022service_label_fr\u0022: \u0022ELASTICSEARCH\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via ELASTICSEARCH:9200 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022target_port_label\u0022: \u00229200 \u00b7 ELASTICSEARCH\u0022, \u0022emulator_service\u0022: \u0022elasticsearch\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022elasticsearch\u0022, \u0022service_banner\u0022: \u0022Elasticsearch 8.11\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229200\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_elasticsearch_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":"Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_elasticsearch_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":168},{"id":7314237,"ip":"31.184.195.244","ts":"2026-10-23 20:38:38.000000","proto":"tcp","src_port":60021,"dst_port":7443,"service":"oracle-em","classification":"oracle_tns_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022oracle-em\u0022, \u0022app_proto\u0022: \u0022oracle-em\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 7443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224f4acff4c9041c67c73fa498ee94611b63a0dc4b\u0022, \u0022event_fingerprint\u0022: \u00223f1d4b52645bcd9531502ab86dc099f88926bef6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022oracle-em\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u0022420e91c120535c16728a9791d446fafc\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7443, \u0022service\u0022: \u0022oracle-em\u0022, \u0022service_name\u0022: \u0022oracle-em\u0022, \u0022risk_score\u0022: 34}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228337755844a0a958ca273ce38e2fca29b5f469d5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 7443, \u0022service\u0022: \u0022oracle-em\u0022, \u0022service_label_fr\u0022: \u0022ORACLE EM\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227443 \u00b7 ORACLE EM\u0022, \u0022emulator_service\u0022: \u0022oracle-em\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022oracle-em\u0022, \u0022service_label_fr\u0022: \u0022ORACLE EM\u0022, \u0022dst_port\u0022: 7443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-oracle-em\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 7443, \u0022service\u0022: \u0022oracle-em\u0022, \u0022service_label_fr\u0022: \u0022ORACLE EM\u0022}, \u0022attack_vector\u0022: \u0022oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00227443 \u00b7 ORACLE EM\u0022, \u0022emulator_service\u0022: \u0022oracle-em\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022oracle_em\u0022, \u0022service_banner\u0022: \u0022honeypot-oracle-em\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_oracle_tns_probe\u0022, \u0022oracle_em_emulated\u0022, \u0022oracle_em_payload\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_oracle_tns_probe\u0022, \u0022oracle_em_emulated\u0022, \u0022oracle_em_payload\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":372},{"id":7248183,"ip":"31.184.195.244","ts":"2026-10-23 17:33:00.000000","proto":"tcp","src_port":60023,"dst_port":22,"service":"ssh","classification":"port_22_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00225353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a\u0022, \u0022emulator_response_len\u0022: 41, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022ssh\u0022, \u0022app_proto\u0022: \u0022ssh\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 22, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221754ac7e847ceb385b4fff1ce5385dae1c9f46d8\u0022, \u0022event_fingerprint\u0022: \u0022bc4e3fa786c83e0db7c1c892cb0c288f6b14388f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022ssh_probe\u0022, \u0022service_name\u0022: \u0022ssh\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u00224d94c79baddfcb6b1b3c2c5fdc6c79e1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 22, \u0022service\u0022: \u0022ssh\u0022, \u0022service_name\u0022: \u0022ssh\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ad80d0d1c304aa449bc9028144e8012232240c08\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 22, \u0022service\u0022: \u0022ssh\u0022, \u0022service_label_fr\u0022: \u0022SSH\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002222 \u00b7 SSH\u0022, \u0022emulator_service\u0022: \u0022ssh\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022ssh\u0022, \u0022service_label_fr\u0022: \u0022SSH\u0022, \u0022dst_port\u0022: 22, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022OpenSSH_8.9p1 Ubuntu\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 22, \u0022service\u0022: \u0022ssh\u0022, \u0022service_label_fr\u0022: \u0022SSH\u0022}, \u0022attack_vector\u0022: \u0022port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002222 \u00b7 SSH\u0022, \u0022emulator_service\u0022: \u0022ssh\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022ssh\u0022, \u0022service_banner\u0022: \u0022OpenSSH_8.9p1 Ubuntu\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002222\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_ssh_probe\u0022, \u0022ssh_emulated\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_ssh_probe\u0022, \u0022ssh_emulated\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":372},{"id":7010518,"ip":"31.184.195.244","ts":"2026-10-23 07:19:42.000000","proto":"tcp","src_port":60023,"dst_port":5000,"service":"flask-http","classification":"web_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c\u0022, \u0022emulator_response_len\u0022: 158, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022flask-http\u0022, \u0022app_proto\u0022: \u0022flask-http\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 5000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002201e979bab5cff3658f796a53a85df7f28227702e\u0022, \u0022event_fingerprint\u0022: \u0022ca12ac856c9aabb53943b247ec13e1d2f927b610\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u00224154520a4208b3f021f35a6cc1dd98ae\u0022}, \u0022service_name\u0022: \u0022flask-http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5000, \u0022service\u0022: \u0022flask-http\u0022, \u0022service_name\u0022: \u0022flask-http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.74, \u0022classification_confidence\u0022: 0.74, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225e5c3a137b2bd6ecd4c981e3f8a433a5d6fe90a6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 5000, \u0022service\u0022: \u0022flask-http\u0022, \u0022service_label_fr\u0022: \u0022FLASK HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225000 \u00b7 FLASK HTTP\u0022, \u0022emulator_service\u0022: \u0022flask-http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 74, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022flask-http\u0022, \u0022service_label_fr\u0022: \u0022FLASK HTTP\u0022, \u0022dst_port\u0022: 5000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-flask-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 5000, \u0022service\u0022: \u0022flask-http\u0022, \u0022service_label_fr\u0022: \u0022FLASK HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via FLASK HTTP:5000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00225000 \u00b7 FLASK HTTP\u0022, \u0022emulator_service\u0022: \u0022flask-http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 74 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022flask_http\u0022, \u0022service_banner\u0022: \u0022honeypot-flask-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022flask_http_emulated\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022flask_http_emulated\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":372},{"id":6937133,"ip":"31.184.195.244","ts":"2026-10-23 03:43:09.000000","proto":"tcp","src_port":60023,"dst_port":11211,"service":"memcached","classification":"memcached_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022454e440d0a\u0022, \u0022emulator_response_len\u0022: 5, \u0022bytes_in\u0022: 168, \u0022payload_entropy\u0022: 5.427683126357951, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022memcached\u0022, \u0022app_proto\u0022: \u0022memcached\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 11211, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 48, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229729913b8cc57d8c7c74ebb8ef8ff39d243bcfd1\u0022, \u0022event_fingerprint\u0022: \u00222fcce8d4fd15e6ca50ec0235eeed2c6616def357\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022INT-INFRA-memcached-stats\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-INFRA-memcached-stats\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 48}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022memcached\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002292dcf26fbe465d00bf320f6ec91f598c\u0022, \u0022path_pattern_hash\u0022: \u0022549d36783f9e3c43618e715d78a40b3b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 11211, \u0022service\u0022: \u0022memcached\u0022, \u0022service_name\u0022: \u0022memcached\u0022, \u0022risk_score\u0022: 48}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002294ebac3403a0bdf072ae24904d82d0a3532b0a99\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022port\u0022: 11211, \u0022service\u0022: \u0022memcached\u0022, \u0022service_label_fr\u0022: \u0022MEMCACHED\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022attack_vector\u0022: \u0022memcached probe \u00b7 via MEMCACHED:11211 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002211211 \u00b7 MEMCACHED\u0022, \u0022emulator_service\u0022: \u0022memcached\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 48\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 48}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 48, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022memcached\u0022, \u0022service_label_fr\u0022: \u0022MEMCACHED\u0022, \u0022dst_port\u0022: 11211, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-INFRA-memcached-stats\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Infra Memcached Stats\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-memcached\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022port\u0022: 11211, \u0022service\u0022: \u0022memcached\u0022, \u0022service_label_fr\u0022: \u0022MEMCACHED\u0022}, \u0022attack_vector\u0022: \u0022memcached probe \u00b7 via MEMCACHED:11211 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022target_port_label\u0022: \u002211211 \u00b7 MEMCACHED\u0022, \u0022emulator_service\u0022: \u0022memcached\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022memcached\u0022, \u0022service_banner\u0022: \u0022honeypot-memcached\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002211211\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_get_probe\u0022, \u0022memcached_emulated\u0022, \u0022memcached_payload\u0022, \u0022mozi_pattern\u0022, \u0022net_memcached_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_get_probe\u0022, \u0022memcached_emulated\u0022, \u0022memcached_payload\u0022, \u0022mozi_pattern\u0022, \u0022net_memcached_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":168},{"id":6769038,"ip":"31.184.195.244","ts":"2026-10-22 20:54:15.000000","proto":"tcp","src_port":60021,"dst_port":9001,"service":"tor-or","classification":"tor_exit_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022030000000000000000\u0022, \u0022emulator_response_len\u0022: 9, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022tor-or\u0022, \u0022app_proto\u0022: \u0022tor-or\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 9001, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022440ce7c613f5d4b93c14838061d74457648958b4\u0022, \u0022event_fingerprint\u0022: \u00222bc74a66a243c40126697f519e65200a159d147e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%\u0022, \u0022confidence\u0022: 0.46, \u0022classification_confidence\u0022: 0.46, \u0022precision_score\u0022: 55, \u0022precision_signals\u0022: [\u0022INT-TOR-exit-hint\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-TOR-exit-hint\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tor-or\u0022, \u0022risk_confidence_factor\u0022: 46.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u0022d2d40d620e587c49ef0af866b893b1d5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9001, \u0022service\u0022: \u0022tor-or\u0022, \u0022service_name\u0022: \u0022tor-or\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220bfda1c8f6ffb104321ff9d2a7f07b44ad64b1ad\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 9001, \u0022service\u0022: \u0022tor-or\u0022, \u0022service_label_fr\u0022: \u0022TOR OR\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tor exit probe \u00b7 via TOR OR:9001 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u00229001 \u00b7 TOR OR\u0022, \u0022emulator_service\u0022: \u0022tor-or\u0022, \u0022confidence_reason\u0022: \u0022Confiance 46 % \u2014 5 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 46 % \u2014 via TOR OR\u0022, \u0022confidence_pct\u0022: 46, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tor-or\u0022, \u0022service_label_fr\u0022: \u0022TOR OR\u0022, \u0022dst_port\u0022: 9001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-TOR-exit-hint\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Tor Exit Hint\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tor-or\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 9001, \u0022service\u0022: \u0022tor-or\u0022, \u0022service_label_fr\u0022: \u0022TOR OR\u0022}, \u0022attack_vector\u0022: \u0022tor exit probe \u00b7 via TOR OR:9001 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00229001 \u00b7 TOR OR\u0022, \u0022emulator_service\u0022: \u0022tor-or\u0022, \u0022confidence_reason\u0022: \u0022Confiance 46 % \u2014 5 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 46 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tor_or\u0022, \u0022service_banner\u0022: \u0022honeypot-tor-or\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_tor_probe\u0022, \u0022tls_clienthello\u0022, \u0022tor_exit_probe\u0022, \u0022tor_or_emulated\u0022, \u0022tor_or_payload\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_tor_probe\u0022, \u0022tls_clienthello\u0022, \u0022tor_exit_probe\u0022, \u0022tor_or_emulated\u0022, \u0022tor_or_payload\u0022]","anomalies":"[]","severity":6,"bytes_in":372},{"id":6709887,"ip":"31.184.195.244","ts":"2026-10-22 18:15:49.000000","proto":"tcp","src_port":60023,"dst_port":11211,"service":"memcached","classification":"memcached_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002256455253494f4e20312e362e360d0a\u0022, \u0022emulator_response_len\u0022: 15, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022memcached\u0022, \u0022app_proto\u0022: \u0022memcached\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 11211, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a0d4041815b62f68b74e4bea9cd476604f6dc8eb\u0022, \u0022event_fingerprint\u0022: \u00222fcce8d4fd15e6ca50ec0235eeed2c6616def357\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022memcached\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u0022549d36783f9e3c43618e715d78a40b3b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 11211, \u0022service\u0022: \u0022memcached\u0022, \u0022service_name\u0022: \u0022memcached\u0022, \u0022risk_score\u0022: 34}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002241bb04017b4a299bc5749425f99a0266c326aa44\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 11211, \u0022service\u0022: \u0022memcached\u0022, \u0022service_label_fr\u0022: \u0022MEMCACHED\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022memcached probe \u00b7 via MEMCACHED:11211 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002211211 \u00b7 MEMCACHED\u0022, \u0022emulator_service\u0022: \u0022memcached\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022memcached\u0022, \u0022service_label_fr\u0022: \u0022MEMCACHED\u0022, \u0022dst_port\u0022: 11211, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-memcached\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 11211, \u0022service\u0022: \u0022memcached\u0022, \u0022service_label_fr\u0022: \u0022MEMCACHED\u0022}, \u0022attack_vector\u0022: \u0022memcached probe \u00b7 via MEMCACHED:11211 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002211211 \u00b7 MEMCACHED\u0022, \u0022emulator_service\u0022: \u0022memcached\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022memcached\u0022, \u0022service_banner\u0022: \u0022honeypot-memcached\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002211211\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022memcached_emulated\u0022, \u0022memcached_payload\u0022, \u0022net_memcached_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022memcached_emulated\u0022, \u0022memcached_payload\u0022, \u0022net_memcached_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":372},{"id":6678639,"ip":"31.184.195.244","ts":"2026-10-22 16:38:48.000000","proto":"tcp","src_port":60021,"dst_port":7070,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002218e9afaf91db6f8a2470e7435c2a1d6b\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 13, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 7070, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b7612a0e1ee6a3f659d7621fba71b805e878a24b\u0022, \u0022event_fingerprint\u0022: \u0022940c30f50809cb73e6af9af3eceb4be96085c74d\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002218e9afaf91db6f8a2470e7435c2a1d6b\u0022, \u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7070, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e98e370dcd69998ee292decb684bd87f62782c5d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u002218e9afaf91db6f8a2470e7435c2a1d6b\u0022, \u0022port\u0022: 7070, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:7070 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227070 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 7070, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u002218e9afaf91db6f8a2470e7435c2a1d6b\u0022, \u0022port\u0022: 7070, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:7070 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00227070 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227070\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"18e9afaf91db6f8a2470e7435c2a1d6b","tls_ja3":"770,49162-49172-57-107-53-61-49159-49161-49187-49169-49171-49191-51-103-50-5-4-47-60-10,61184-65281-10-11-35-13172-30031-5,23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":372},{"id":6593229,"ip":"31.184.195.244","ts":"2026-10-22 13:44:22.000000","proto":"tcp","src_port":60023,"dst_port":2375,"service":"docker","classification":"docker_api_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234\u0022, \u0022emulator_response_len\u0022: 162, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022docker\u0022, \u0022app_proto\u0022: \u0022docker\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 2375, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 60.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222ccd4c4fc8fd5c686e5688a02e374628fbd51708\u0022, \u0022event_fingerprint\u0022: \u002200a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 34}, \u0022service_name\u0022: \u0022docker\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u0022f1831d9f4a5a77b3112c071eb8abe3e6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2375, \u0022service\u0022: \u0022docker\u0022, \u0022service_name\u0022: \u0022docker\u0022, \u0022risk_score\u0022: 34}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c9aadbdb2e1082d964877a01001b61fa3107de24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 2375, \u0022service\u0022: \u0022docker\u0022, \u0022service_label_fr\u0022: \u0022DOCKER\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222375 \u00b7 DOCKER\u0022, \u0022emulator_service\u0022: \u0022docker\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022docker\u0022, \u0022service_label_fr\u0022: \u0022DOCKER\u0022, \u0022dst_port\u0022: 2375, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Docker 24.0.5\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 2375, \u0022service\u0022: \u0022docker\u0022, \u0022service_label_fr\u0022: \u0022DOCKER\u0022}, \u0022attack_vector\u0022: \u0022docker api probe \u00b7 via DOCKER:2375 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00222375 \u00b7 DOCKER\u0022, \u0022emulator_service\u0022: \u0022docker\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022docker\u0022, \u0022service_banner\u0022: \u0022Docker 24.0.5\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222375\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022docker_api_probe\u0022, \u0022docker_emulated\u0022, \u0022docker_payload\u0022, \u0022net_docker_api_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022docker_api_probe\u0022, \u0022docker_emulated\u0022, \u0022docker_payload\u0022, \u0022net_docker_api_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":372},{"id":6509249,"ip":"31.184.195.244","ts":"2026-10-22 10:15:20.000000","proto":"tcp","src_port":60023,"dst_port":6379,"service":"redis","classification":"port_6379_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00222d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a\u0022, \u0022emulator_response_len\u0022: 34, \u0022bytes_in\u0022: 168, \u0022payload_entropy\u0022: 5.427683126357951, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022redis\u0022, \u0022app_proto\u0022: \u0022redis\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 6379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 42.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 46.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 46.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225402c9916180e82dae639eb541e81260d5f1fe65\u0022, \u0022event_fingerprint\u0022: \u00229c536ce82edfb6f83700eeb7934e9ac49a41747b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 46.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022redis_probe\u0022, \u0022service_name\u0022: \u0022redis\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002292dcf26fbe465d00bf320f6ec91f598c\u0022, \u0022path_pattern_hash\u0022: \u002242eb67f6877c6439dbde87dd6ec1f324\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6379, \u0022service\u0022: \u0022redis\u0022, \u0022service_name\u0022: \u0022redis\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.61 Mobile Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002216bb13d7139a3d3ba5b3b970609a7c4c3f03e834\u0022, \u0022protocol_details\u0022: {\u0022redis_command_fr\u0022: \u0022Sonde protocole Redis\u0022, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022port\u0022: 6379, \u0022service\u0022: \u0022redis\u0022, \u0022service_label_fr\u0022: \u0022REDIS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022attack_vector\u0022: \u0022port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226379 \u00b7 REDIS\u0022, \u0022emulator_service\u0022: \u0022redis\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 46.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022redis\u0022, \u0022service_label_fr\u0022: \u0022REDIS\u0022, \u0022dst_port\u0022: 6379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Redis 7.0\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022redis_command_fr\u0022: \u0022Sonde protocole Redis\u0022, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022port\u0022: 6379, \u0022service\u0022: \u0022redis\u0022, \u0022service_label_fr\u0022: \u0022REDIS\u0022}, \u0022attack_vector\u0022: \u0022port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-N920C) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/101.0.4951.\u0022, \u0022target_port_label\u0022: \u00226379 \u00b7 REDIS\u0022, \u0022emulator_service\u0022: \u0022redis\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022redis\u0022, \u0022service_banner\u0022: \u0022Redis 7.0\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_redis_probe\u0022, \u0022redis_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_redis_probe\u0022, \u0022redis_emulated\u0022]","anomalies":"[]","severity":7,"bytes_in":168},{"id":6349325,"ip":"31.184.195.244","ts":"2026-10-22 03:53:23.000000","proto":"tcp","src_port":60023,"dst_port":9042,"service":"cassandra","classification":"cassandra_native","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022840000000200000002\u0022, \u0022emulator_response_len\u0022: 9, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022cassandra\u0022, \u0022app_proto\u0022: \u0022cassandra\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 9042, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002240a95b0e32b0df6949d23e1558297d2ebdc45aed\u0022, \u0022event_fingerprint\u0022: \u0022a0aaefdb49226dd6e2577aeda4227e02b3ddd691\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022service_name\u0022: \u0022cassandra\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u00228cb32c8386aedd3a6f34609a4f02f539\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9042, \u0022service\u0022: \u0022cassandra\u0022, \u0022service_name\u0022: \u0022cassandra\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226302ac7204997ec590e3a3689f5684b06e8cf66e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 9042, \u0022service\u0022: \u0022cassandra\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00229042 \u00b7 CASSANDRA\u0022, \u0022emulator_service\u0022: \u0022cassandra\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022cassandra\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA\u0022, \u0022dst_port\u0022: 9042, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 9042, \u0022service\u0022: \u0022cassandra\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA\u0022}, \u0022attack_vector\u0022: \u0022cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00229042 \u00b7 CASSANDRA\u0022, \u0022emulator_service\u0022: \u0022cassandra\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229042\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022net_cassandra_native\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022net_cassandra_native\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":372},{"id":6307797,"ip":"31.184.195.244","ts":"2026-10-22 02:03:28.000000","proto":"tcp","src_port":60023,"dst_port":3306,"service":"mysql","classification":"mysql_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400\u0022, \u0022emulator_response_len\u0022: 60, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022mysql\u0022, \u0022app_proto\u0022: \u0022mysql\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 3306, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 48, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a246aa7fbaca41c12f7f0beae72af258e6547eca\u0022, \u0022event_fingerprint\u0022: \u00227e64d2ea7efbfd080eb620b69c685e7503a67a61\u0022, \u0022classification_reason\u0022: \u0022Poign\u00e9e de main MySQL \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-DB-mysql-auth\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-DB-mysql-auth\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mysql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u0022f92b97805e8111d6d69ad0f096b65c87\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3306, \u0022service\u0022: \u0022mysql\u0022, \u0022service_name\u0022: \u0022mysql\u0022, \u0022risk_score\u0022: 48}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Poign\u00e9e de main MySQL \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1110\u0022], \u0022mitre\u0022: \u0022T1110\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022389a19611ac26e5f5da9e93a575237eb0d66d4c0\u0022, \u0022protocol_details\u0022: {\u0022mysql_auth_fr\u0022: \u0022Handshake MySQL (auth)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 3306, \u0022service\u0022: \u0022mysql\u0022, \u0022service_label_fr\u0022: \u0022MYSQL\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022mysql probe \u00b7 via MYSQL:3306 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223306 \u00b7 MYSQL\u0022, \u0022emulator_service\u0022: \u0022mysql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Poign\u00e9e de main MySQL \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Poign\u00e9e de main MySQL \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 48\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 48, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022mysql\u0022, \u0022service_label_fr\u0022: \u0022MYSQL\u0022, \u0022dst_port\u0022: 3306, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-DB-mysql-auth\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Db Mysql Auth\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1110\u0022, \u0022mitre_technique\u0022: \u0022T1110\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u00228.0.32-MySQL\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mysql_auth_fr\u0022: \u0022Handshake MySQL (auth)\u0022, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 3306, \u0022service\u0022: \u0022mysql\u0022, \u0022service_label_fr\u0022: \u0022MYSQL\u0022}, \u0022attack_vector\u0022: \u0022mysql probe \u00b7 via MYSQL:3306 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223306 \u00b7 MYSQL\u0022, \u0022emulator_service\u0022: \u0022mysql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mysql\u0022, \u0022service_banner\u0022: \u00228.0.32-MySQL\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223306\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mysql_emulated\u0022, \u0022mysql_handshake\u0022, \u0022net_mysql_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mysql_emulated\u0022, \u0022mysql_handshake\u0022, \u0022net_mysql_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":372},{"id":6197921,"ip":"31.184.195.244","ts":"2026-10-21 21:09:57.000000","proto":"tcp","src_port":60024,"dst_port":120,"service":"http","classification":"exploit_attempt","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002289045de4436406d32451958670f5d6fa9b7c368b\u0022, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 160, \u0022payload_entropy\u0022: 5.394383861485529, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 120, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a724f2bc1199771de24f2b346f8ca984421f6a72\u0022, \u0022event_fingerprint\u0022: \u00225ddc0fd948f2b25361d383948abc57684fb72942\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.62, \u0022classification_confidence\u0022: 0.62, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022c35707c914cd73f0e52fb426c5da363e\u0022, \u0022payload_hash\u0022: \u0022e9f24338f2b42a5d3cbfcca97e6c7dc7\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 120, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.13\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.136 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.136 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.13\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.136 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.136 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.13\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022451838c6bdf7875631399557ec3e4c682cfcb225\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.136 Safari\/537.36\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.13\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:120 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 62, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 120, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.136 Safari\/537.36\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:120 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.13\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022120\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/79.0.3945.136 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":8,"bytes_in":160},{"id":6106000,"ip":"31.184.195.244","ts":"2026-10-21 17:34:29.000000","proto":"tcp","src_port":60021,"dst_port":28888,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002218e9afaf91db6f8a2470e7435c2a1d6b\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 13, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 28888, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225cf412bcd6d328f155d7597a369aacffe158456a\u0022, \u0022event_fingerprint\u0022: \u00225874d3ff1eff55ffcafecd2434b12079c46a29fd\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002218e9afaf91db6f8a2470e7435c2a1d6b\u0022, \u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 28888, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b20ff7a97ffb62dd39872d3aa4911498737da42e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u002218e9afaf91db6f8a2470e7435c2a1d6b\u0022, \u0022port\u0022: 28888, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:28888 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002228888 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 28888, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u002218e9afaf91db6f8a2470e7435c2a1d6b\u0022, \u0022port\u0022: 28888, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:28888 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002228888 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"18e9afaf91db6f8a2470e7435c2a1d6b","tls_ja3":"770,49162-49172-57-107-53-61-49159-49161-49187-49169-49171-49191-51-103-50-5-4-47-60-10,61184-65281-10-11-35-13172-30031-5,23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":372},{"id":5384377,"ip":"31.184.195.244","ts":"2026-10-20 14:10:22.000000","proto":"tcp","src_port":33778,"dst_port":120,"service":"http","classification":"exploit_attempt","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/aab9","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00228c3ba4e54c80033bb0eb3abd0f7efce05fb2e43a\u0022, \u0022http_host_hash\u0022: \u002223dc7230b74f1cc9ebfb0c3b281df39d038ca2e5\u0022, \u0022http_target_hash\u0022: \u0022b3f4578f5d08ec9238131e5d1d7cdc7a4060eab8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 214, \u0022payload_entropy\u0022: 5.39244821129785, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 120, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 43, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a6e2fe814ab13f95a01699ea597caec0ed1affac\u0022, \u0022event_fingerprint\u0022: \u0022d3982ec334727233909eaa589fde7760545cd398\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.7, \u0022classification_confidence\u0022: 0.7, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022c9554303c69678cfc5b4c18fc25f610f\u0022, \u0022payload_hash\u0022: \u0022febe91fce9d49bf2b3bbf3d88e2b4582\u0022, \u0022path_pattern_hash\u0022: \u002274f81771c93b4c2568676f1c522025ef\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 120, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 43}, \u0022payload_preview\u0022: \u0022GET \/aab9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like \u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aab9\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/aab9 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aab9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\\r\\nAccept-Encoding: gzip\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/aab9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aab9\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/aab9 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aab9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\\r\\nAccept-Encoding: gzip\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/aab9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d84163d66ef36fafe24ed5b86cb474fd2c9421d3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aab9\u0022, \u0022request_line\u0022: \u0022GET \/aab9 HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/aab9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:120 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aab9\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 70, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 43, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 120, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aab9\u0022, \u0022request_line\u0022: \u0022GET \/aab9 HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:120 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aab9\u0022, \u0022evidence_snippet\u0022: \u0022GET \/aab9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022120\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:120","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","anomalies":"[]","severity":7,"bytes_in":214},{"id":5384376,"ip":"31.184.195.244","ts":"2026-10-20 14:10:22.000000","proto":"tcp","src_port":33766,"dst_port":120,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022674c9b60629e4885877f5ec76f21723e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 1453, \u0022payload_entropy\u0022: 7.7043147568926305, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 120, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e034b9f6dd39cc8df2e5fa43ee4c250dcd31f2c9\u0022, \u0022event_fingerprint\u0022: \u00229f9738c331ec27e55b384b19b3dfaa2208003b7c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.57, \u0022classification_confidence\u0022: 0.57, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022674c9b60629e4885877f5ec76f21723e\u0022, \u0022payload_hash\u0022: \u002258f5366eb1ea416f43ae1c3869a94a6c\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 120, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003_\u0138*D\ufffdG4b\u07cb=\\u0000]\ufffd\ufffdA\ufffd\u0026\\u0010\ufffd\\t\ufffd\ufffd\ufffd\\u0001\ufffdsT\\u001cD v~\u003C\ufffd\ufffd\\u0002\ufffd\ufffd\ufffd\ufffdz\ufffdie\\u001a\ufffd\\u0017Y\ufffd\ufffd\ufffd\\b\\\u0022\\\u0022\\u001au\u0026\ufffd\ufffd\\u0001\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003_\u0138*D\ufffdG4b\u07cb=\\u0000]\ufffd\ufffdA\ufffd\u0026\\u0010\ufffd\\t\ufffd\ufffd\ufffd\\u0001\ufffdsT\\u001cD v~\u003C\ufffd\ufffd\\u0002\ufffd\ufffd\ufffd\ufffdz\ufffdie\\u001a\ufffd\\u0017Y\ufffd\ufffd\ufffd\\b\\\u0022\\\u0022\\u001au\u0026\ufffd\ufffd\\u0001\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\nc\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0004\ufffd\\u0004\ufffdc\ufffd\\u0004\ufffd~\u002744\ufffdH\\u0010\u94aa\ufffd\ufffd\\u0012\ufffdYg\\u001a\ufffd\ufffd\ufffdj\ufffd\ufffdn\ufffd\ufffdy\u0027\ufffdKsVW\ufffd\ufffd\\\u0022\ufffdc\ufffdn\u0026r3e\ufffda\ufffdGa\ufffdrO\\\u0022\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003_\u0138*D\ufffdG4b\u07cb=\\u0000]\ufffd\ufffdA\ufffd\u0026\\u0010\ufffd\\t\ufffd\ufffd\ufffd\\u0001\ufffdsT\\u001cD v~\u003C\ufffd\ufffd\\u0002\ufffd\ufffd\ufffd\ufffdz\ufffdie\\u001a\ufffd\\u0017Y\ufffd\ufffd\ufffd\\b\\\u0022\\\u0022\\u001au\u0026\ufffd\ufffd\\u0001\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a597a653f54264ce02bcdd7a0471695fbbc9be29\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003_\u0138*D\ufffdG4b\u07cb=\\u0000]\ufffd\ufffdA\ufffd\u0026\\u0010\ufffd\\t\ufffd\ufffd\ufffd\\u0001\ufffdsT\\u001cD v~\u003C\ufffd\ufffd\\u0002\ufffd\ufffd\ufffd\ufffdz\ufffdie\\u001a\ufffd\\u0017Y\ufffd\ufffd\ufffd\\b\\\u0022\\\u0022\\u001au\u0026\ufffd\ufffd\\u0001\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022674c9b60629e4885877f5ec76f21723e\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd_\u0138*D\ufffdG4b\u07cb=]\ufffd\ufffdA\ufffd\u0026\ufffd\\t\ufffd\ufffd\ufffd\ufffdsTD v~\u003C\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdie\ufffdY\ufffd\ufffd\ufffd\\\u0022\\\u0022u\u0026\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffdA\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:120 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 57, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 120, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003_\u0138*D\ufffdG4b\u07cb=\\u0000]\ufffd\ufffdA\ufffd\u0026\\u0010\ufffd\\t\ufffd\ufffd\ufffd\\u0001\ufffdsT\\u001cD v~\u003C\ufffd\ufffd\\u0002\ufffd\ufffd\ufffd\ufffdz\ufffdie\\u001a\ufffd\\u0017Y\ufffd\ufffd\ufffd\\b\\\u0022\\\u0022\\u001au\u0026\ufffd\ufffd\\u0001\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022674c9b60629e4885877f5ec76f21723e\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:120 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd_\u0138*D\ufffdG4b\u07cb=]\ufffd\ufffdA\ufffd\u0026\ufffd\\t\ufffd\ufffd\ufffd\ufffdsTD v~\u003C\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffdie\ufffdY\ufffd\ufffd\ufffd\\\u0022\\\u0022u\u0026\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffdA\ufffd\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022120\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"674c9b60629e4885877f5ec76f21723e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-43-51,25497-29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":1453},{"id":5384375,"ip":"31.184.195.244","ts":"2026-10-20 14:10:22.000000","proto":"tcp","src_port":33760,"dst_port":120,"service":"http","classification":"exploit_attempt","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/aaa9","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00228c3ba4e54c80033bb0eb3abd0f7efce05fb2e43a\u0022, \u0022http_host_hash\u0022: \u002223dc7230b74f1cc9ebfb0c3b281df39d038ca2e5\u0022, \u0022http_target_hash\u0022: \u0022648198a7d8b1903b592d541b8e145992b8e32488\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 214, \u0022payload_entropy\u0022: 5.3835690779806065, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 120, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 43, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a6e2fe814ab13f95a01699ea597caec0ed1affac\u0022, \u0022event_fingerprint\u0022: \u0022b1602e987ba72e972bbf107e813e17b7fa4cdd43\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.7, \u0022classification_confidence\u0022: 0.7, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022c9554303c69678cfc5b4c18fc25f610f\u0022, \u0022payload_hash\u0022: \u00224514326b0d1b6bc573d6eea20ebd46ec\u0022, \u0022path_pattern_hash\u0022: \u00221ade1e65553ece740bc33f1030dd9fea\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 120, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 43}, \u0022payload_preview\u0022: \u0022GET \/aaa9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like \u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aaa9\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/aaa9 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aaa9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\\r\\nAccept-Encoding: gzip\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/aaa9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aaa9\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/aaa9 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aaa9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\\r\\nAccept-Encoding: gzip\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/aaa9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002282f637f1c7b35afe346f9879ad4324decf9d05ec\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aaa9\u0022, \u0022request_line\u0022: \u0022GET \/aaa9 HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/aaa9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:120 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aaa9\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 70, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 43, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 120, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aaa9\u0022, \u0022request_line\u0022: \u0022GET \/aaa9 HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:120 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aaa9\u0022, \u0022evidence_snippet\u0022: \u0022GET \/aaa9 HTTP\/1.1\\r\\nHost: 62.3.50.33:120\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022120\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 96}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:120","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.77 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","anomalies":"[]","severity":7,"bytes_in":214},{"id":5384372,"ip":"31.184.195.244","ts":"2026-10-20 14:10:21.000000","proto":"tcp","src_port":33746,"dst_port":120,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022674c9b60629e4885877f5ec76f21723e\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 1453, \u0022payload_entropy\u0022: 7.755455118028618, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 120, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e034b9f6dd39cc8df2e5fa43ee4c250dcd31f2c9\u0022, \u0022event_fingerprint\u0022: \u00229f9738c331ec27e55b384b19b3dfaa2208003b7c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022674c9b60629e4885877f5ec76f21723e\u0022, \u0022payload_hash\u0022: \u002233b5ea7c41f66dad3f73ec973e60f5ce\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 120, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\u003C\ufffdW\ufffd\ufffd\\u001b\ufffd\\u0000\ufffd\\u001f\ufffdi\ufffdR\\u001a\ufffd\ufffdu\ufffd\\u001a\\u0018\\n\ufffd!\\u0016\\u000e\ufffdq\ufffd\ufffd \\u001fHGr\ufffd\\t\ufffdx\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0011\\u0018bE:s\ufffdj\\u001fH\ufffd\ufffd\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\u003C\ufffdW\ufffd\ufffd\\u001b\ufffd\\u0000\ufffd\\u001f\ufffdi\ufffdR\\u001a\ufffd\ufffdu\ufffd\\u001a\\u0018\\n\ufffd!\\u0016\\u000e\ufffdq\ufffd\ufffd \\u001fHGr\ufffd\\t\ufffdx\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0011\\u0018bE:s\ufffdj\\u001fH\ufffd\ufffd\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\nc\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0004\ufffd\\u0004\ufffdc\ufffd\\u0004\ufffdg\ufffd1,\ufffd(\\u001a\ufffd`\ufffd\\u0013h\ufffd\u003E\u003E\ufffd+U\ufffd.}\ufffd\\u0011\ufffd\ufffdOg8q\ufffd\\b\\u0001\ufffdt\ufffd\ufffd\ufffd{\\u0016\u0109\ufffdX\ufffd\ufffd\\f\ufffd\ufffd\ufffd\ufffd\ufffd:|\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\u003C\ufffdW\ufffd\ufffd\\u001b\ufffd\\u0000\ufffd\\u001f\ufffdi\ufffdR\\u001a\ufffd\ufffdu\ufffd\\u001a\\u0018\\n\ufffd!\\u0016\\u000e\ufffdq\ufffd\ufffd \\u001fHGr\ufffd\\t\ufffdx\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0011\\u0018bE:s\ufffdj\\u001fH\ufffd\ufffd\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022478031c34bd7daff6ebf58f0eaa9a935f9ca0dd5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\u003C\ufffdW\ufffd\ufffd\\u001b\ufffd\\u0000\ufffd\\u001f\ufffdi\ufffdR\\u001a\ufffd\ufffdu\ufffd\\u001a\\u0018\\n\ufffd!\\u0016\\u000e\ufffdq\ufffd\ufffd \\u001fHGr\ufffd\\t\ufffdx\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0011\\u0018bE:s\ufffdj\\u001fH\ufffd\ufffd\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022674c9b60629e4885877f5ec76f21723e\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\u003C\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffdR\ufffd\ufffdu\ufffd\\n\ufffd!\ufffdq\ufffd\ufffd HGr\ufffd\\t\ufffdx\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdbE:s\ufffdjH\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffdA\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:120 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 120, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\u003C\ufffdW\ufffd\ufffd\\u001b\ufffd\\u0000\ufffd\\u001f\ufffdi\ufffdR\\u001a\ufffd\ufffdu\ufffd\\u001a\\u0018\\n\ufffd!\\u0016\\u000e\ufffdq\ufffd\ufffd \\u001fHGr\ufffd\\t\ufffdx\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0011\\u0018bE:s\ufffdj\\u001fH\ufffd\ufffd\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022674c9b60629e4885877f5ec76f21723e\u0022, \u0022port\u0022: 120, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:120 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\u003C\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffdR\ufffd\ufffdu\ufffd\\n\ufffd!\ufffdq\ufffd\ufffd HGr\ufffd\\t\ufffdx\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdbE:s\ufffdjH\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffdA\ufffd\u0022, \u0022target_port_label\u0022: \u0022120 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022120\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"674c9b60629e4885877f5ec76f21723e","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-43-51,25497-29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":1453},{"id":4859892,"ip":"31.184.195.244","ts":"2026-10-19 17:56:20.000000","proto":"tcp","src_port":37208,"dst_port":14567,"service":"http","classification":"http","waf_score":3,"waf_tags":"[\u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00228f70bcb6fa12d6f9618bfc12da1177fff7a7bc57\u0022, \u0022http_host_hash\u0022: \u00221ac989948bdf09c4710d46930ad97dc45baf3074\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 64, \u0022payload_entropy\u0022: 4.790873781480404, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 14567, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 8.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 8.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228affd1af3be05ee536fb9a3665a984a2ec0689f0\u0022, \u0022event_fingerprint\u0022: \u0022a4f2a96230fbc99f8811919a4417f9fcd09276b9\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022839d98aac393eabedcd815b51e257d25\u0022, \u0022payload_hash\u0022: \u0022588b5b22de5f0eeb6d15d92e7944cc3f\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 14567, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nUser-Agent: fasthttp\\r\\nHost: 62.3.50.33:14567\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022fasthttp\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nUser-Agent: fasthttp\\r\\nHost: 62.3.50.33:14567\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nUser-Agent: fasthttp\\r\\nHost: 62.3.50.33:14567\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022fasthttp\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nUser-Agent: fasthttp\\r\\nHost: 62.3.50.33:14567\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nUser-Agent: fasthttp\\r\\nHost: 62.3.50.33:14567\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%\u0022}, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 8.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022confidence\u0022: 0.58, \u0022classification_confidence\u0022: 0.58, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022840ef0f77cb4d5709c684d88582570514312b492\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022fasthttp\u0022, \u0022port\u0022: 14567, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nUser-Agent: fasthttp\\r\\nHost: 62.3.50.33:14567\u0022, \u0022attack_vector\u0022: \u0022http \u00b7 via HTTP:14567 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002214567 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 8.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 14567, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022fasthttp\u0022, \u0022port\u0022: 14567, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http \u00b7 via HTTP:14567 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nUser-Agent: fasthttp\\r\\nHost: 62.3.50.33:14567\u0022, \u0022target_port_label\u0022: \u002214567 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002214567\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950734:sap-sapcontrol-path\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:14567","http_user_agent":"fasthttp","http_referer":null,"tags":"[\u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":1,"bytes_in":64},{"id":4853891,"ip":"31.184.195.244","ts":"2026-10-19 17:45:32.000000","proto":"tcp","src_port":52292,"dst_port":9876,"service":"rocketmq","classification":"rocketmq_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022526f636b65744d510000000000000001\u0022, \u0022emulator_response_len\u0022: 16, \u0022bytes_in\u0022: 1453, \u0022payload_entropy\u0022: 7.757283904047647, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022service\u0022: \u0022rocketmq\u0022, \u0022app_proto\u0022: \u0022rocketmq\u0022, \u0022asn\u0022: 34665, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 9876, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022dcfa01e8d235953dad7040af4c74b3a53907f70e\u0022, \u0022event_fingerprint\u0022: \u002269f1f514dc809742bc860cf5cf92d1f1632ae0f0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rocketmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022, \u0022confidence\u0022: 0.74, \u0022classification_confidence\u0022: 0.74, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022INT-mq-rocketmq\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-mq-rocketmq\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rocketmq\u0022, \u0022risk_confidence_factor\u0022: 74.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 34665, \u0022org\u0022: \u0022Petersburg Internet Network ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022bef480f5b137c4cab4eefc0bbc016908\u0022, \u0022path_pattern_hash\u0022: \u00228b2a26f80b92afb16ccccb333b802d2c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9876, \u0022service\u0022: \u0022rocketmq\u0022, \u0022service_name\u0022: \u0022rocketmq\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd-\\tFtxJ].\u023d3o\\u0018\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd@q\ufffd\u0165}^\ufffd@  \ufffdR\ufffd\ufffd(\\u0018\ufffdy\\u0015\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffdc\ufffdy\ufffdn\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\/\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd-\\tFtxJ].\u023d3o\\u0018\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd@q\ufffd\u0165}^\ufffd@  \ufffdR\ufffd\ufffd(\\u0018\ufffdy\\u0015\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffdc\ufffdy\ufffdn\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\/\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\nc\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0004\ufffd\\u0004\ufffdc\ufffd\\u0004\ufffd=\ufffd(\ufffd\/=\ufffd}\ufffd\ufffd\ufffd\\u0016Bg\ufffd\u077a\\u0007\\u0010\ufffdz\ufffdM\ufffd\ufffdw\\n\ufffd\\u0005\ufffd\ufffd=\ufffdL\ufffdXf\\u0016\ufffd\u0309\ufffd0\\\u0022\ufffdC\ufffd\\u001d\ufffd\ufffd\\u0019\ufffd\ufffdxc\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd-\\tFtxJ].\u023d3o\\u0018\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd@q\ufffd\u0165}^\ufffd@  \ufffdR\ufffd\ufffd(\\u0018\ufffdy\\u0015\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffdc\ufffdy\ufffdn\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\/\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab rocketmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229a1766721a09e8a41ec83677a2628f0be1e0d33b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd-\\tFtxJ].\u023d3o\\u0018\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd@q\ufffd\u0165}^\ufffd@  \ufffdR\ufffd\ufffd(\\u0018\ufffdy\\u0015\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffdc\ufffdy\ufffdn\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\/\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 9876, \u0022service\u0022: \u0022rocketmq\u0022, \u0022service_label_fr\u0022: \u0022ROCKETMQ\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd-\\tFtxJ].\u023d3o\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd@q\ufffd\u0165}^\ufffd@  \ufffdR\ufffd\ufffd(\ufffdy\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffdc\ufffdy\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffdA\ufffd\u0022, \u0022attack_vector\u0022: \u0022rocketmq probe \u00b7 via ROCKETMQ:9876 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00229876 \u00b7 ROCKETMQ\u0022, \u0022emulator_service\u0022: \u0022rocketmq\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab rocketmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab rocketmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 74, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022rocketmq\u0022, \u0022service_label_fr\u0022: \u0022ROCKETMQ\u0022, \u0022dst_port\u0022: 9876, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-mq-rocketmq\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Mq Rocketmq\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rocketmq\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd-\\tFtxJ].\u023d3o\\u0018\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd@q\ufffd\u0165}^\ufffd@  \ufffdR\ufffd\ufffd(\\u0018\ufffdy\\u0015\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffdc\ufffdy\ufffdn\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\/\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005A\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 9876, \u0022service\u0022: \u0022rocketmq\u0022, \u0022service_label_fr\u0022: \u0022ROCKETMQ\u0022}, \u0022attack_vector\u0022: \u0022rocketmq probe \u00b7 via ROCKETMQ:9876 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd-\\tFtxJ].\u023d3o\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd@q\ufffd\u0165}^\ufffd@  \ufffdR\ufffd\ufffd(\ufffdy\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffdc\ufffdy\ufffdn\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffdA\ufffd\u0022, \u0022target_port_label\u0022: \u00229876 \u00b7 ROCKETMQ\u0022, \u0022emulator_service\u0022: \u0022rocketmq\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 74 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rocketmq\u0022, \u0022service_banner\u0022: \u0022honeypot-rocketmq\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229876\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rocketmq_probe\u0022, \u0022rocketmq_emulated\u0022, \u0022rocketmq_payload\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rocketmq_probe\u0022, \u0022rocketmq_emulated\u0022, \u0022rocketmq_payload\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":1453}],"total_events":25}