{"ip":"34.128.72.88","exported_at":"2026-08-06T01:07:32+00:00","period_days":30,"metrics":{"events7d":10,"distinct_ports":1,"distinct_classifications":1,"max_severity":8,"last_sensor_id":"paris-1","max_waf_score":16,"max_risk_score":59,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["path_traversal","config_leak_scan"],"recommended_action":"monitor","confidence":1,"risk_breakdown":{"waf":40,"classification":74,"behavior":0,"geo":40,"protocol":35,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"T1083","top_mitre_technique":"T1083","top_mitre_count":10,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":40,"classification":74,"behavior":0,"geo":40,"protocol":35,"novelty":15,"risk_score":47},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":100,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["SIGMA-web-config-leak","Http Sensitive","pat-0191","Upstream"],"tags_summary":["SIGMA-web-config-leak","INT-http_sensitive","pat-0191","INT-upstream"],"attack_vector":"config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.save","protocol_details":{"http_method":"GET","http_path":"\/.env.save","request_line":"GET \/.env.save HTTP\/1.1","http_user_agent":"crusader-worker\/1.0","port":82,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/.env.save \u00b7 UA crusader-worker\/1.0 \u00b7 HTTP:82","evidence_snippet":"GET \/.env.save HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82","target_port_label":"82 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF","classification_reason":"Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%","classification_reason_label_fr":"Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF","payload_preview":"GET \/.env.save HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:82"},"events":[{"id":14971210,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":53932,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022env\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u00229ee0d3f55b39072ba6bec6203d26e470be80afdc\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 89, \u0022payload_entropy\u0022: 4.894358999263641, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 48, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ee2fb6aa06ccefddbe54d8b623ad4d6ab7b3d898\u0022, \u0022event_fingerprint\u0022: \u0022923b03ecbe6dc33ec434181b836057f12790b1fe\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 240, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u0022410217cc1a4ebe328bceb1448f33e733\u0022, \u0022path_pattern_hash\u0022: \u0022aef81e7735de8f42b73e111497498c8b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 48}, \u0022payload_preview\u0022: \u0022GET \/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022597c3b1644eb1941dd2489e4eb47d0e766407b62\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env\u0022, \u0022request_line\u0022: \u0022GET \/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 48, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env\u0022, \u0022request_line\u0022: \u0022GET \/.env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_env\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_env\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":7,"bytes_in":89},{"id":14971211,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":53938,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.local","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022local\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u00221bd3d14a0dcd500ff7a77dd7b961ff8960851334\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 95, \u0022payload_entropy\u0022: 4.92639090970507, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 48, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b7fb824058d53ec9aae081ba32a4acefa9f23d77\u0022, \u0022event_fingerprint\u0022: \u0022951685301f50a7374617da698a2faa0bcfc093e0\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 295, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0193\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0193\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022, \u0022pat-0193\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022, \u0022Probe \/.env.local\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022, \u0022pat-0193\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u00224e48405db4dae3e5a6a6e8f400b8e683\u0022, \u0022path_pattern_hash\u0022: \u0022b9c24fc1b97f40588adfd0796c248786\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 48}, \u0022payload_preview\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.local\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.local HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.local\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.local HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228417a5cd0cdd59f6bd1f2f5484a04101ea263e02\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.local\u0022, \u0022request_line\u0022: \u0022GET \/.env.local HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.local\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 48, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0193\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0193\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.local\u0022, \u0022request_line\u0022: \u0022GET \/.env.local HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.local\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.local HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_env_local\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_probe_env_local\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":7,"bytes_in":95},{"id":14971212,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":53950,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.production","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022production\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u00229b39fa6529cda07275007291b337879405a04c62\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 100, \u0022payload_entropy\u0022: 4.936014505759609, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228c27660d3db584b38633e86e1bd72a6daa966e42\u0022, \u0022event_fingerprint\u0022: \u002285265d4678826b41903cc2acd448d90c34df2ca0\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 295, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0194\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0194\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022, \u0022pat-0194\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022, \u0022Probe \/.env.production\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022, \u0022pat-0194\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u0022eef6a67aa97a738cf3d93f4a0ac19a2b\u0022, \u0022path_pattern_hash\u0022: \u0022a397c8c79032c8a19624fdccf1ae5680\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.production\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.production HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.production\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.production HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224b726a150cd1f507d19b8a234ff403366ccd3592\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.production\u0022, \u0022request_line\u0022: \u0022GET \/.env.production HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.production\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0194\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0194\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.production\u0022, \u0022request_line\u0022: \u0022GET \/.env.production HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.production\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.production HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":7,"bytes_in":100},{"id":14971213,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":53964,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.prod","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022prod\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u0022dbae5bda5d181ccfbfc6b75e40a8edbe5f27e87d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.899918044191729, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228c27660d3db584b38633e86e1bd72a6daa966e42\u0022, \u0022event_fingerprint\u0022: \u0022468d8971f6835beeca991ac6ab6e099e543c5375\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 240, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u002239d64786bc820e2672b64b42fbf156b8\u0022, \u0022path_pattern_hash\u0022: \u0022d6acfe32219429bb20e7ee2ee79adb21\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/.env.prod HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.prod\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.prod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.prod HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.prod HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.prod\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.prod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.prod HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.prod HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228a4aff7ebf6a17ba397664cc7e62d79841a473fa\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.prod\u0022, \u0022request_line\u0022: \u0022GET \/.env.prod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.prod HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.prod\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.prod\u0022, \u0022request_line\u0022: \u0022GET \/.env.prod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.prod\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.prod HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":7,"bytes_in":94},{"id":14971214,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":53992,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":16,"waf_tags":"[\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/.env.bak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022bak\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u00224a5fcefd2e38e385c845c219c16c9499f238dece\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 93, \u0022payload_entropy\u0022: 4.924866914662245, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 59, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022693b70d74c6c9bb6c8ec4ce6ff9dffed0f489a1e\u0022, \u0022event_fingerprint\u0022: \u0022ce55d4f25056a79dfca1fe6677517e498ba49b92\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 270, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u0022b6068c2b102a6563ae4de2d3b2f24471\u0022, \u0022path_pattern_hash\u0022: \u0022e884c8b66a9cc0dbcd8816b9898313a2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 59}, \u0022payload_preview\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.bak\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/.env.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.bak\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/.env.bak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022914c1208194be3b5b847e6ee3ec20a14f34e67c8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.bak\u0022, \u0022request_line\u0022: \u0022GET \/.env.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.bak\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 59, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.bak\u0022, \u0022request_line\u0022: \u0022GET \/.env.bak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.bak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.bak HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":8,"bytes_in":93},{"id":14971215,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":53998,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":16,"waf_tags":"[\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022]","http_method":"GET","http_target":"\/.env.old","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022old\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u00225c6d2af3e13d17105c8f5fb6187fb5c332303b42\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 93, \u0022payload_entropy\u0022: 4.93013815117486, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 59, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022693b70d74c6c9bb6c8ec4ce6ff9dffed0f489a1e\u0022, \u0022event_fingerprint\u0022: \u00228b34b1e5586c95c0012e15eb34d7c8a5a1aaedd7\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 270, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u00220ac6ecbc0c79d2f2ce5e43f5639a852d\u0022, \u0022path_pattern_hash\u0022: \u00223807eb1255fb0315f3ffbb94c31e25e0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 59}, \u0022payload_preview\u0022: \u0022GET \/.env.old HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.old\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/.env.old HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.old HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.old HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.old\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022, \u0022leak-8\u0022], \u0022request_line\u0022: \u0022GET \/.env.old HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.old HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.old HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022efce8b9fa76fc8007dd25b07d62903a14c1f6fb6\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.old\u0022, \u0022request_line\u0022: \u0022GET \/.env.old HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.old HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.old\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 59, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.old\u0022, \u0022request_line\u0022: \u0022GET \/.env.old HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.old\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.old HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_probe_env\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":8,"bytes_in":93},{"id":14971216,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":54008,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.dev","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022dev\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u0022a499321530f3e4ddd283e6792cf6d67b1e7cfe88\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 93, \u0022payload_entropy\u0022: 4.89372071087472, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228c27660d3db584b38633e86e1bd72a6daa966e42\u0022, \u0022event_fingerprint\u0022: \u0022b69f8e684c1e581c73995666492c6e201fccb934\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 240, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u002249be0d260b0e297103d117231afcaef0\u0022, \u0022path_pattern_hash\u0022: \u0022ceb221ca10f5b573c09ea91320781e08\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/.env.dev HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.dev\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.dev HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.dev HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.dev HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.dev\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.dev HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.dev HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.dev HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227936f4e041fcdb738bd98c71132b6e4908f32bd0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.dev\u0022, \u0022request_line\u0022: \u0022GET \/.env.dev HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.dev HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.dev\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.dev\u0022, \u0022request_line\u0022: \u0022GET \/.env.dev HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.dev\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.dev HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":7,"bytes_in":93},{"id":14971217,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":53978,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.backup","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022backup\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u00220cdfae489c44fe084f54d0d07b1f18ad12bec86e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 96, \u0022payload_entropy\u0022: 4.937783892705967, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228c27660d3db584b38633e86e1bd72a6daa966e42\u0022, \u0022event_fingerprint\u0022: \u00227e6b372eae0e2dd0ec1e8c5588c194fcef0b05e3\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 295, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0192\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0192\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022, \u0022pat-0192\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022, \u0022Probe \/.env.backup\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022, \u0022pat-0192\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u0022aaf60d0cff32ae1feed536b0556248d8\u0022, \u0022path_pattern_hash\u0022: \u002246237bd90c824ac71e080a2ce5957ff9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/.env.backup HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.backup\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.backup HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.backup HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.backup HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.backup\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.backup HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.backup HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.backup HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022215ec39cde8fee33a6dc34c0531fa9cafac0b982\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.backup\u0022, \u0022request_line\u0022: \u0022GET \/.env.backup HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.backup HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.backup\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0192\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022pat-0192\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.backup\u0022, \u0022request_line\u0022: \u0022GET \/.env.backup HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.backup\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.backup HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":7,"bytes_in":96},{"id":14971218,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":54018,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.example","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022example\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u0022080963ef62d711207d0e68706f04d0705ec4d7fa\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 97, \u0022payload_entropy\u0022: 4.964661591000207, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228c27660d3db584b38633e86e1bd72a6daa966e42\u0022, \u0022event_fingerprint\u0022: \u0022ec0abaa4061a67e5024faddc421ad4995d226235\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 240, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u0022f2f23528fa2843aa2f4d4b189646247f\u0022, \u0022path_pattern_hash\u0022: \u0022f8bf22cb3ab23601599be7f21fa00aee\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.example\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.example HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.example\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.example HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dd914f30149230871d9a02cdbfd2c35bdfd42bb3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.example\u0022, \u0022request_line\u0022: \u0022GET \/.env.example HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.example\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.example\u0022, \u0022request_line\u0022: \u0022GET \/.env.example HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.example\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.example HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":7,"bytes_in":97},{"id":14971219,"ip":"34.128.72.88","ts":"2026-08-01 13:20:51.000000","proto":"tcp","src_port":54006,"dst_port":82,"service":"http","classification":"config_file_probe","waf_score":8,"waf_tags":"[\u0022950514:leak-1\u0022]","http_method":"GET","http_target":"\/.env.save","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022save\u0022, \u0022http_ua_hash\u0022: \u0022655df0f3f911a15b4f4bf8e4813996a4ecac7879\u0022, \u0022http_host_hash\u0022: \u0022b00c56701bd04898edc8a488547d32d613363649\u0022, \u0022http_target_hash\u0022: \u0022b6acd8fd883f6c293e3cda5fd50434818eb0b3df\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.878887061067306, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022ID\u0022, \u0022dst_port\u0022: 82, \u0022risk_waf\u0022: 40.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228c27660d3db584b38633e86e1bd72a6daa966e42\u0022, \u0022event_fingerprint\u0022: \u0022456a2488f6f070abf37e3288dd5ea62e0d8b676a\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 240, \u0022precision_signals\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0191\u0022], \u0022matched_pattern_names\u0022: [\u0022Probe \/.env\u0022], \u0022pattern_ids\u0022: [\u0022pat-0191\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022ID\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002216953de589ee631f0fcf6d96eceb8f57\u0022, \u0022payload_hash\u0022: \u0022beddba0303aa45d648a0e52d0938cfad\u0022, \u0022path_pattern_hash\u0022: \u0022f8bd9e65b618d21d6e757070964bc6e1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/.env.save HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.save\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.save HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.save HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.save HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/.env.save\u0022, \u0022user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950514:leak-1\u0022], \u0022waf_rule_names\u0022: [\u0022leak-1\u0022], \u0022request_line\u0022: \u0022GET \/.env.save HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/.env.save HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/.env.save HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022918a37e425ae9a16109f3db6b816aca93849aab7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.save\u0022, \u0022request_line\u0022: \u0022GET \/.env.save HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/.env.save HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.save\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab leak-1 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 40.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 82, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022INT-http_sensitive\u0022, \u0022pat-0191\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-config-leak\u0022, \u0022Http Sensitive\u0022, \u0022pat-0191\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/.env.save\u0022, \u0022request_line\u0022: \u0022GET \/.env.save HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022crusader-worker\/1.0\u0022, \u0022port\u0022: 82, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:82 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/.env.save\u0022, \u0022evidence_snippet\u0022: \u0022GET \/.env.save HTTP\/1.1\\r\\naccept: *\/*\\r\\nuser-agent: crusader-worker\/1.0\\r\\nhost: 62.3.50.33:82\u0022, \u0022target_port_label\u0022: \u002282 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 40 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002282\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:82","http_user_agent":"crusader-worker\/1.0","http_referer":null,"tags":"[\u0022950514:leak-1\u0022, \u0022http_backup_file_scan\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":7,"bytes_in":94}],"total_events":10}