34.158.209.85

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.864952799414356,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "fcaf064a26ac77c378fba61f3188911e",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003M\u001f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffdTI\ufffddx\u031c\ufffd6\ufffd\ufffd\ufffdC#\f\ufffd\r\u073d\ufffd\u000b\ufffd '\ufffd\ufffd\ufffd\u0798\ufffdN\ufffd\u000f\ufffd+U\u001e\u0019\ufffd\ufffd7y%\ufffd\ufffd\ufffd,\ufffd\u0006\\\ufffd\ufffd6\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "592cb61486c188fa3488fed562add4272df87f86",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.809781118254145,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "e2b8b211a80c49eeb2245c289dfaa8cf",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011\ufffdSG\u01bfq\u05cf\ufffd]\ufffd\ufffd\ufffdyP\\\ufffd\ufffdq\ufffd\ufffd%\ufffd\ufffd\f\ufffd\ufffd\ufffd\u0001\u00123 \u000e[\u0014!m\u000f!\ufffd\ufffd$\ufffd\f\u001e\ufffd\u000f;\/Y;\ufffd'\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd\b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "5ecad97fc8e1f61852243055e8fc879c3ee0b436",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8178753325694945,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "9e7c9d675e4699f6a91c797335b09d1c",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`N\ufffd?\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\tO(OX\ufffd\ufffd\u000b\ufffd'\ufffdig\ufffd_\ufffd\ufffd\"\r\ufffd \ufffd\ufffd\/k\ufffd5=\u000f\ufffdC\u0007\ufffdO\ufffd\u001f\\\ufffd\u077d,\u0006\ufffdnne\ufffdQ\ufffdR\u0018!\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "1e65849813ed1078107afd24e0589c2c33c238c3",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.818911432483743,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "29c8a169fd0bfca0c7124beb2a9ecf40",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\b\ufffd\ufffd\ufffdv\u0002\u001a\ufffd\ufffd6<`!\u036d\ufffd\u0011\u0011\ufffd-\ufffd\u000bb\ufffd\ufffd\u0003\ufffd\u0010\u0006.\ufffd \ufffd;\ufffd\ufffdU\ufffd\u001e\ufffdTg\ufffd\ufffdf\ufffdzO\ufffd\u000e\ufffd\ufffdq\ufffd,\ufffdq\ufffd\ufffdBD\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "0e5186dbc34e00a97d231ba7e411ac6da1d9defc",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8448404310755,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "81eafd13febe154218ce1fc051b0213e",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Bk\ufffd\u0004\ufffdq\ufffd\ufffd\ufffdU\ufffdn\ufffd\ufffd\u051f\ufffd\u001cH\u04c5\ufffd\ufffdp\ufffd\ufffd1\ufffdh\ufffd[o \f\u0003)\u001c_\u0006\u00c9\ufffd\ufffd\ufffd\u0150\u0012\ufffd\ufffd\u035cmz\ufffdV\n\ufffd\u0012L\u000b\ufffd\ufffd\ufffd\ufffd?\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "763a6598ebd2f7ef4132c251fc91e0da2124c944",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8701624751375245,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "063c3e619d23aad0142de9cb2cd99835",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdl,\ufffdXh\ufffdJ\ufffd\ufffd\ufffd\ufffdB%\ufffd\ufffd.\ufffdgU%\ufffd\u0012\u07fb\b\ufffd\ufffd5 >\ufffd\u05dd\ufffd<\u0015mT\ufffdo\ufffdX\ufffdhL!\ufffdO\u0015\ufffd>\u0013\u0006]\ufffd\ufffd\ufffdXn\ufffdc\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "8489ebe09811a77cf5bf169c474a7a53cc371a74",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8376832546949515,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "b2cb840f0cc252d2b4ccd73738fe555e",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\fV\ufffd\r\ufffdS\ufffdZ\ufffd\u0297\ufffd\ufffdz^\u000b+X\ufffdz\ufffd\u0012@\ufffdcs\ufffd\u0006b\ufffd\/\ufffd Ux\ufffdq\ufffd\ufffd\r\ufffdP\ufffd\ufffd\ufffd\u0007\ufffd \ufffd\ufffd\u0016!\ufffd\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd0X\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "a594c72e8482adca58eef1972819fcfa63deb7f5",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.813619029069375,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "9ec0e7e4bd6a3b60a18aea9f8acd3bd8",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0016\u0001R\u001d=\ufffdx\u0002\u0001\ufffd\ufffd\u0012\u0016,\ufffdf\ufffdo\u0003\ufffdq.\ufffd\u0525l\/\ufffd:\ufffd\ufffd\ufffd \ufffd\u0015\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd2h1\ufffd\ufffd%\ufffd\u0018\ufffd$\ufffd[\ufffdZz\ufffd\u001b\ufffd\u001a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "dee5795fdb07f90f72b72caec6fa7250c03bfdce",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.890758227502941,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "650903eaac0db4645ca4d73953cd61fa",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001fo\ufffd\ufffd\u00bf^R\ufffd\ufffd\ufffdu\ufffd|\ufffd\u01f2dV<[\ufffd\ufffd\ufffd;\ufffd\u0005\ufffd\ufffd\ufffd, \u0015]\ufffd@<\u0000V\ufffd\u0012|\ufffdUg.Z\ufffd\ufffd\tD<\"\u0005\ufffd9\ufffd0n\u0011\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "dd8e238d3b4a07f5acf538a1d0599d8aaa1d66dc",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.857667492471954,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "addc312932ed73504e54b130534c7ded",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003W\ufffd\ufffdC^\ufffd\ufffduz,\"\ufffd\ufffd8[\u0260 \u000biI\ufffd\ufffdBk\ufffd\ufffd\ufffd\ufffd\u068a\ufffd \ufffd\u0010\ufffdD\ufffd\u000f\ufffd4\u0012\ufffd\ufffdv|\u05d3z\ufffd\u048d=)\ufffd\ufffd\ufffd\ufffdy~6t\b\ufffdG\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "492e173f07ba9b20082f74165da2a233ea56ae7f",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.828321470953423,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "5cfeb8b296d095c1d6df44b78a1ce1bb",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003F\t\u06ce\ufffd\ufffd\u001d\u0010\ufffd&\ufffd\ufffd \ufffd)\ufffd|>\ufffd\ufffdL\ufffd\ufffda'\ufffd\ufffd@\ufffd\ufffdr\ufffd \ufffdP\ufffd\ufffd<\u0004\ufffd@ $\u0006cgn@z|\u0002\ufffd\ufffd\/\u5c3e\/F\ufffdL\ufffd\ufffd]\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "7c64256341891ea3a4624742c3f772541761f03c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.820036688515646,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "20f19390b767f5ba5b47efafce39ce6b",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdb\u024f\ufffd1\ufffdt\u0010\u0010\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffdp\ufffd7T\u0002\ufffd\u0004\ufffdLe\u0004\ufffd\ufffdH \ufffd\ufffd\ufffdw\ufffd\u0000K\ufffd{\ufffd?\ufffdT=\u0001<K\ufffd\ufffd\ufffd|\ufffdK\ufffd\ufffd\ufffdHf>\ufffd7\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "3a4f8fd8fd53f3c666b340572608dba589386e58",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.889174913634104,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "f51ca24a9957f360675258af37196bf6",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u000326,\ufffdO\u0012I\ufffd\ufffd(\u0010\ufffdf\ufffdsAcGD7q<g\ufffd-\ufffd\ufffdg\ufffd\u001f\u000e\ufffd \ufffdo\ufffd\u001b\ufffdE\u00b5\ufffdyJu*\ufffd\uf070Z \ufffd\ufffd\ufffdGn\ufffd\ufffd\ufffd>$ \u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "9750ade10f73c8d564f4872692da8b907bf10d3a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.901382261523613,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "14414fa9c09dbb2144d4977a426204d0",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001e\ufffd\ufffdnQ\ufffd\u000e\ufffdI4\ufffd\ufffd+\ufffd#D\u5e4f~\ufffd7qL\u0000rP\ufffdRX! R9bq\ufffd\ufffd\u0005~\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd@\ufffdk\ufffd\ufffd\u000f\ufffd\ufffd]\u0013\ufffdp\ufffd6\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "f0998962a9888ddae8661c2adbe2653f2146057c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.84769559134115,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "356e3058397d973a480ee715e9a1b348",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdc\u033c\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\u0012?\u0007\u001cc\ufffdy\ufffd\u0010\ufffd\ufffd\ufffd!\ufffdX\ufffdzA FC\ufffdd\ufffdD\ufffd\u0730\u001crL~C\u0013u\u0004j\u001c9\u0001\ufffd?\ufffd\u0005\ufffd\ufffd`<\u0004z\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "525b10f350db4d11c88d2e0234f42048c1c7b08f",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.821848538409528,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "952af45325c051ecab21552d9f754a7b",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003W\ufffd\ufffd I\ufffd\ufffd\ufffdt\ufffdH[\ufffdl\ufffd\u0168\ufffd\ufffdB\u0010\\\u0000\ufffdVMH\ufffd\u000f\ufffdU \ufffd2^\u0000\ufffd1U\n.\u0007#\ufffd\ufffd\ufffdGn\ufffd\ufffd\u0018fo\ufffd\ufffd\ufffd\u001c\ufffd#\ufffd%\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "ae5f6a236c8f70589fc69e5544b3ebebfbfd449d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.889882322510729,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "452782794af7df28e0891aac0f982428f9846fdf",
    "event_fingerprint": "4a81a696cc07b6dc59ba2b0bb4f7eb806502f33b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "72580f22e3b61b2baf6c73579e5fde22",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003$\u001a\ufffdQ\ufffd\b\ufffd\u00a9\ufffd\u01bf\ufffd\ufffd\u0017\ufffd,\u0015\ufffd\ufffd&\ufffdwW\u0005\ufffd\ufffd\ufffdx1\ufffdd \ufffd\u001f\ufffd\u0015\ufffdXD\u001e\ufffd(4\ufffd{<\ufffd~\ufffdB\ufffd\u0015\ufffdzZZ\ufffdp\u0532\ufffd\";\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "9ae2d6753070afaaf23de53d1eede2cdd612d235",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "48aff90a9151363feb81bf29408595188f824823",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "23a7fdebb2c6a62d7d99ec7e14a583ee335f985b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 269,
    "payload_entropy": 5.441941258652686,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "69cb45ba3e78398b707c3193fc658b71375eb140",
    "event_fingerprint": "b03312a5c39697dd577f89994e0220ad9ee99df8",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "226697356d23b3595e00d7b9fcf683eb",
        "payload_hash": "f1f411c2488c7e71f4bdbb637faf66dd",
        "path_pattern_hash": "cccb8d748e9f900a4a8cbc953ef4ca7f"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 1,
    "classification_confidence": 1,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; A37f Build\/LMY47V) AppleWeb",
    "event_signature": "c7c876cd94e95d28f7971386ac1f69b4c650752f",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "48aff90a9151363feb81bf29408595188f824823",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "fbbc2fe6ffa673120e2143579206c207fd9a2f04",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 271,
    "payload_entropy": 5.436173710219148,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c4693058dc208c02e185847b29ce9ab6710c784a",
    "event_fingerprint": "54e2c7e38ed17fb0b7bc08691b426adc03a84da3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "226697356d23b3595e00d7b9fcf683eb",
        "payload_hash": "a475ee606c4266e683ecfff32c6d5797",
        "path_pattern_hash": "603fa88b9ea2fe408c03592c8df3f75e"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; A37f Build\/LMY47V) AppleW",
    "event_signature": "810a0675ab7feccd9cc5721eff8b180c33e6cbf6",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "5285b767cd64ebc8eddc7d617959f31795403d28",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "514e7d3a4a3b92e1be2515643df9985485409f7e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 249,
    "payload_entropy": 5.426758192862164,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "69cb45ba3e78398b707c3193fc658b71375eb140",
    "event_fingerprint": "4bfef060a62a83232649ef4dc6e8ac4743e78d0c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9d43022f716c611ffef9990e855ea7df",
        "payload_hash": "75931ded3475299a0da045a97fbb61f6",
        "path_pattern_hash": "b207f8075f9179f23f0d3550b27348d0"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 1,
    "classification_confidence": 1,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (K",
    "event_signature": "9a4e0b65f2a3361ea60ec06cfb2929ded785bdb3",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "old",
    "http_ua_hash": "318183d121e1f16483ccc1f30be8798e0d15b4da",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "24c516a67db44cfad409a699aaddb7e13edd5983",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 271,
    "payload_entropy": 5.467494664131014,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "58af0c6411e5712bd864b31f41897c4d03dbbd8e",
    "event_fingerprint": "e75ebc0d8e5d2acb10ed1d7373c289438083b891",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e81ce31b7f91a91ed29916c22dc987a4",
        "payload_hash": "4a7e8d93835c627e4a25d908baa11201",
        "path_pattern_hash": "5fcd528564d98f34a98115294a2df668"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 1,
    "classification_confidence": 1,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/wp-config.php.old HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1; C6740N Build\/LMY47O) AppleW",
    "event_signature": "beb4a957ae707874b76392784d6ffe2e402081b8",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950518:leak-5",
        "950521:leak-8",
        "http_backup_path",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "sql",
    "http_ua_hash": "c8f58d748399180805eaaeee0454038e043d96b9",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "89e3ee2ac1f546ba2343b32b34c80a90ae032b45",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 315,
    "payload_entropy": 5.343008247978297,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 36,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 36,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "3816fd635d70e26da7de6148cfa2d34ae5a01ee7",
    "event_fingerprint": "78ccb4b116fe476247f422add5a2044b9ae2862c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "28ca8b6fccda72430248080823299054",
        "payload_hash": "8a4bdc144c9187ec68a22ca692f3f3be",
        "path_pattern_hash": "9cdd3dcff31741f42f122f89da0d4f8c"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/mysqldump.sql HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser",
    "event_signature": "890d98e2287db1a1592a7eb5ab755be2d58fce32",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "http_backup_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yaml",
    "http_ua_hash": "2e3941afe9af64acac6b04d5776247677ae92839",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "4b8c3a91cc09ea22fce0bbb577426e64fe04c86c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 265,
    "payload_entropy": 5.505605578059258,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "8e17bdf997aeb78ffe1904c4fc6ec693a25298c1",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "eee9483cf6c6beee1c699d123688fba5",
        "payload_hash": "acb2b94e7d28d5fa6abdf78be3ea206b",
        "path_pattern_hash": "ceffd3c347f61c55757e37ab82366886"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/helm\/values.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-AU) AppleWebKit\/534.35 ",
    "event_signature": "d55c397e0e6524b69c1f2554d28e1ba26ef675b0",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "bak",
    "http_ua_hash": "3f32132dbe84a287a80051f4aa2e818bcb4776e4",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "d73217ca969ed03b12511b11b89b08b96130cc19",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 270,
    "payload_entropy": 5.466230998763701,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 92,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 92,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "2921ad7267d9ab9923a6f4cf0ac840f31d60a833",
    "event_fingerprint": "24180d218f2981139398cd1fb8e16a37c44cfe6b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4f4fe3a75e702492145e55fa4256a9ca",
        "payload_hash": "6ce27946ee73902f422cd4c4e165bfc3",
        "path_pattern_hash": "513fb4daa4f4d1d20414ef0e31bb8617"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/wp-config.bak HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (hp-tablet; Linux; hpwOS\/3.0.2; U; de-DE) AppleWebKi",
    "event_signature": "ab74c3fdfe0aa2c4d5ea0e45c96017159369b942",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950521:leak-8",
        "http_backup_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "php",
    "http_ua_hash": "c47b0bb56a4f7346f2c7cae2031c872de1990cbd",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "f971bf8f22fd021ef405c24b8881915ea7b1fbe0",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 271,
    "payload_entropy": 5.416644683900779,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "35bc2bda1446d56bd03fca8b18e9e2ae06eeac45",
    "event_fingerprint": "e8d4c95b555e13b077c29f836a9764f081649790",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b0b2e522f7b991a523fa4ef9f0d23ae5",
        "payload_hash": "7f3763104db33f7d5e4c9718fce12217",
        "path_pattern_hash": "00f0907ad6288d75ebc36cdda29800e8"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/local-config.php HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/534.24 (KHTML, li",
    "event_signature": "26a1981ee11e7c8ab385c70b0b860746077a7daa",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "6db5a3149771ca2ccbc88247150379bb7fb8f492",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "3ae157cd8c43defb5d30e0d7c5c707aa388091b2",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 269,
    "payload_entropy": 5.410059239451454,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "35bc2bda1446d56bd03fca8b18e9e2ae06eeac45",
    "event_fingerprint": "fc38168aa04017c5a7133a580cfab9f07865a883",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "54f4fdf0c1513a3bfb676ab12b95a518",
        "payload_hash": "bdde219fb2340231ea0a1bf43114fdb4",
        "path_pattern_hash": "650438fe08df7df13d88963bd8b41670"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/appsettings.Production.json HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWeb",
    "event_signature": "15f88cd79975f91f4c4028755c6820fe4bc87bbb",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "4184044bad7ba51283d3e6840c5dbec309a6ef27",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "9af9cb129e55c20d8a5abcb3dfd6798fb7b03f7d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 254,
    "payload_entropy": 5.38183070253574,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "35bc2bda1446d56bd03fca8b18e9e2ae06eeac45",
    "event_fingerprint": "727287dd7609ed13662d373fee649519e36a1ce1",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "2eaa9eb4cc81509736c0f74aaadee18f",
        "payload_hash": "7042441cd2ab0afdd4f7ca0e0a5dfddd",
        "path_pattern_hash": "8879b59407d37d82c9009d4ff34dd568"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/wp-config.txt HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/537.",
    "event_signature": "a2cfd6b96884548390b1e31e85314fe6eef57f9f",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "a5e043dfd1f09154fc6fd257d561ecd0a25910bf",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "ca1a81175cd9e58e9e1d76706220c73a85edea6c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 259,
    "payload_entropy": 5.40815775803783,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c4693058dc208c02e185847b29ce9ab6710c784a",
    "event_fingerprint": "a7a5a95eabbbaf9b342dea173d545b5cbb323ea9",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "16f13230547e19a8f5dc26c9437db736",
        "payload_hash": "5c0e7950c3532221d07c6389c8f27723",
        "path_pattern_hash": "bf4cbe1c6a04f0ce19969bc5a096ab48"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/settings.yml HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel 2 XL) AppleWebKit\/537.36",
    "event_signature": "fba97ca7e5bef337148494cc73a669e2f84544e8",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "2353cd7686a3901b6d38c08254dc02f3a7a85d94",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "c7925f5b0f216247bb0a000827dd8b1a02615d1d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 271,
    "payload_entropy": 5.414505851916995,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c4693058dc208c02e185847b29ce9ab6710c784a",
    "event_fingerprint": "fe5b1cf21e2c35c0a9583b21f7b438c00d087495",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "029012e7b5b45afcecfe3b8421090f39",
        "payload_hash": "613ec35adab159d73845780751f4903f",
        "path_pattern_hash": "a85c0cffdce7f3cd5f8342a635486f8c"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 10_0 like Mac OS X) AppleWebKit\/601",
    "event_signature": "7326341715369a080d85ea7f9f1dacd908d34dff",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "sql",
    "http_ua_hash": "138be3cba11203174b5b31911e1a05a35f035f3a",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "d35d1926a5a36dbda6ae11c86dc2eedd3f572820",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 253,
    "payload_entropy": 5.443963038628535,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 50,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "dc9a43e89672ba718912fbbb068e7143dbf213bd",
    "event_fingerprint": "c7e49a213abe9960af618a3e12a50a1cce116a55",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e4aae174e2be385424703b741b519268",
        "payload_hash": "c957153f05a560513c16e7ac38562c16",
        "path_pattern_hash": "125450e34c63efe667deeb1ac059bb35"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/pg_dump.sql HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel 2 XL) AppleWebKit\/537.36 (KHT",
    "event_signature": "a72ad377d7c7b1b2b8d260964674df4483231d1b",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "http_backup_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "php",
    "http_ua_hash": "a11794fa8e20da6ebae602a42116221fc6b6cc64",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "bac3b02f1ce936e593505ba9114b968f810c00c8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 267,
    "payload_entropy": 5.369308996504611,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "75728ef6162b9893f533b0d3276332bc0aa61c88",
    "event_fingerprint": "a1b09fc4967cdab8b47b3b8c432fcd12163a9e97",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "126ac9de105e171da0d26ed62ccad55b",
        "payload_hash": "c8eebd01b5383241cfc766fb9af1bbfd",
        "path_pattern_hash": "9823c90115688ca8a60aa1cefb3b4c36"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/bootstrap\/cache\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_1) App",
    "event_signature": "e489653eb949b4ed39bc66a8b49a8ad460f6c8a3",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "8f2baab3b964307cdf854bfbcf3eed824d99b1d8",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "4f55dc51ea1dea9fa7f5925bb0b65cb16d0fdae1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 276,
    "payload_entropy": 5.464178176611656,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "f9cf447ca4a2527310badb998df650b999c4fd9b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "8b67b17ddb2cc47cef61d7e7b6781a78",
        "payload_hash": "ef28f526b7eab2d5c07c550c65b7e71e",
        "path_pattern_hash": "59785b98ffcc7d5aed7dc5ac932d796d"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LEX829) AppleWebKit\/537.36 (",
    "event_signature": "af29f10432de8f15803ef6afe5e8afe2987b1eb4",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "properties",
    "http_ua_hash": "6ec0e2c609cbf0f1f6dedcd6c01512118f104033",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "2f953c642188869b1a561e9c4740c219cba11ed1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 180,
    "payload_entropy": 5.100187762510572,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 56,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 56,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "721ca885ac0987d71a377dbafe5aa9e0e45ef3e3",
    "event_fingerprint": "460bdc960b77d0e6dcd6f006fe771ac65379ac1a",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "979370e78956152b21fbd5bf7981a555",
        "payload_hash": "99b9881f166300b2c243afd785c36f3f",
        "path_pattern_hash": "286c03092fb4d6bd8948d162eabf9d1a"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: SEC-SGHX210\/1.0 UP.Link\/6.3.1.13.0\r\nAccept-Charset:",
    "event_signature": "1cf48706e9457ad46ebc7da992accd02a81e7ef7",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "log",
    "http_ua_hash": "f25bb0e0284eba994afae54c7a6576d5ef8e0938",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "8fec6092b6d50f048de7f5341eb923ae4a4ab6d3",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 271,
    "payload_entropy": 5.401647527150801,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "0876beea902d3e4f45160cbd3ea4b9627f58f364",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e2d12ebef65bb43da52dd27e4e4b72ce",
        "payload_hash": "38512a7365731ed189503fa4f98d3d25",
        "path_pattern_hash": "6f29914bb94c22caf991d0657dba887c"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; Intel Mac OS X; en-US) App",
    "event_signature": "564350b389b9f17a49815c1dccb22c75094bf885",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "561f018309fdaf39c9271ab4fc29282616b6a63f",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "dd4e7c6dae63b29d8a16bb2d08dd16eadae1388d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 163,
    "payload_entropy": 5.209736974227356,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 50,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f87941f06d9a786ccd47a815c91e95138151742c",
    "event_fingerprint": "7bd133df098e33ca17f5a245c6d7b4a0638c2721",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fdbe2934e3db6ba0900d463898361927",
        "payload_hash": "ecd77c5f70d825a042805271454a010c",
        "path_pattern_hash": "6b5c0538270e7ecfd1e78d9e9655554f"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/backend\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/2.02E (Win95; U)\r\nAccept-Charset: utf-8\r\nAccept-En",
    "event_signature": "a4ad3fd563bd38cf3ee2ecc4636b14a905b62fe1",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "289f4c295ae7f09c1eee743f7f4cd8518b47179b",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "0f76041769be813ece64207c970ee1807850a543",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 253,
    "payload_entropy": 5.3953411344505575,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "75728ef6162b9893f533b0d3276332bc0aa61c88",
    "event_fingerprint": "f8f4b55beb6c7787f8f18fdf28b469f22cb7208e",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "95883dd05f3e1c6a42007821f8bf3c58",
        "payload_hash": "3b43234a4be2958bdf379e3577e6c81a",
        "path_pattern_hash": "5736f534a7045a63aa72293badb5c26d"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/backend\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit",
    "event_signature": "2dee3a30bce575df5653f9f19983c052013d3996",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "c1c1bde123fbda9b83f4d6156cd3b28c2797d20e",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "a126963d241c6de5415e84028949599a8cc00b17",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 268,
    "payload_entropy": 5.448687404092355,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "f8f491f7bf27db02f89783da87050ab5ea4e37bf",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "65a9a2f402a488c7f9c458cde878f2c7",
        "payload_hash": "1fa9e2e1c2e67dd85f5def67055486a7",
        "path_pattern_hash": "db11239f2df73531510aaf9c947f6a5d"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/backend\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KH",
    "event_signature": "a08020cb33be98865486b85e35915f82f6f6e3e2",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "4fc70ddd732570bc60748e141fe15b6a888a584e",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "e62be8f1d3ea8a3426a6fb1fa9e5d83e116ec98e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 282,
    "payload_entropy": 5.370312147564954,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "9485dc2ae2ae67c11b360168a546b01ce2d21cb0",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "05cb8061a6d3bac94d637c6509a58057",
        "payload_hash": "6a41ef79a71c3b810a2aa31d1463e640",
        "path_pattern_hash": "cda9a8724ef71a87cddf01e6053d46ca"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/backend\/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) Ap",
    "event_signature": "b5cdf6e681f6190de39b70a2192ad4e5870709d9",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "6b41ff44ca06f9b7c73adafd5b0b76534b105975",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "3b0f704debd9557578c7b95595853680ba57e853",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 150,
    "payload_entropy": 5.062172005623195,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 48,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 48,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d49fd0090194d616b74a4e58bbbe66e44570781d",
    "event_fingerprint": "54da32a7bb541c56bd9dc0274ba55cabea7891b9",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c0e46bd1f86cd2220d2e7283962bc905",
        "payload_hash": "6fe9a6e8fd46884e9fdd9253cf5d7209",
        "path_pattern_hash": "0e4dd4a2248d9ed0c82f50221193673a"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Googlebot-News\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r",
    "event_signature": "1ac0006a37088966c78492587f6ec9083805d609",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "yml",
    "http_ua_hash": "d61171168b95dbb6f5fda454ff9a5fe3927ed0b5",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "cc8382c07ae1d99dcd8bb8a9e6a6c1ada2d7d586",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 276,
    "payload_entropy": 5.433869338692581,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "4dd39ee95aef17ff96d109225a65d4816b2b056a",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9ddb9802525f1d2316c3a2056b73a9a7",
        "payload_hash": "7640f1a581aa76eddd6b8e604923b8c7",
        "path_pattern_hash": "14e465936c1b9cf9455ba711f44752e2"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/config\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (",
    "event_signature": "5a31a91de6da9b7cedb138fed95aaecf8241a967",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "yaml",
    "http_ua_hash": "5285b767cd64ebc8eddc7d617959f31795403d28",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "83aab3d7a9203cac49bf41e0b5a1c79c704b2790",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 261,
    "payload_entropy": 5.442446658429895,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "559602b022eac00b5ecee58ed0770c0edb9a9f96",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9d43022f716c611ffef9990e855ea7df",
        "payload_hash": "03eb0727cde89136526b35eea15df78e",
        "path_pattern_hash": "8c6e5c3e505e4438940b3e0a90e2956a"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/config\/parameters.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebK",
    "event_signature": "243d29cfc410187656bcf075e27efde395d7b132",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "69854b4a1a430d4537656e6297382d451850e14f",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "eaa807d97ed075164ad06a16fff4f79030561dd8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 198,
    "payload_entropy": 5.288765777759106,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 76,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 76,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 56,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "f55ea03f1c9e5c6d508e2dda9510b1ee0c87fe35",
    "event_fingerprint": "3aa7c75f59c6674b0b8f52478e803e60ba1b5f4d",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c4a5ce99862b4a5986f04ee2e1e42b56",
        "payload_hash": "92b13dcdc5423aadad170e40752f5aff",
        "path_pattern_hash": "f35df1fc019a96ac8898ec6340239854"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90",
    "event_signature": "85c0593ad46ccedab623cc5c43ede9ad8ae73584",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "py",
    "http_ua_hash": "aa4c6891ed84895612f24c43fa8ccb843a2447a3",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "785278c4abd87c1e8614b6fc434460fa3c60167e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 232,
    "payload_entropy": 5.297086608489798,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "3a710b15b77db8ec7f68925d0bab94d29927997b",
    "event_fingerprint": "b88f32be1a71221de9ba9d22684de9d89d0b3f0a",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "564613f0c7e98a0c62a60e6fdecaf4c5",
        "payload_hash": "5eed569424e417bdd6abccc6e4112656",
        "path_pattern_hash": "cfa2a71e8214ea6e643d4c02e89cc6cb"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/settings\/local.py HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9.",
    "event_signature": "2c0b2a80cc4e9028a8ba437a31b80c0ef48dabfc",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_settings",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "yml",
    "http_ua_hash": "616bca6c2b0aa8f8d45a9de706f86b703be609a0",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "0bba21d28f20bda74433ccee2bdac84d5c74ee34",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 229,
    "payload_entropy": 5.380827097528788,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "979ca4bdbabc96f71e9679586703e3c9cc835add",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "2787e25ca12e16cb50469fec88cfc9cd",
        "payload_hash": "f182484975d7d841898d98165166b607",
        "path_pattern_hash": "2af106832c70de3d5060ddf93222a1d3"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/config\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i586; en-US; rv:1.7.3) Gecko\/",
    "event_signature": "b0575913f5a699b498ee7994eab20904436909bc",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "py",
    "http_ua_hash": "ab48b72c0a6eee0aa9986264dd514c99cad2fbd5",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "e3978a68997e27e7c0be3cc288a529b4c552616f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 276,
    "payload_entropy": 5.347323353206714,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "0d080f779efddf777f9a21350882901c011c4768",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "8e63a6d9611cab20c06527104cc8dbd2",
        "payload_hash": "ab0308010304ecb8cff1ae919b4b7874",
        "path_pattern_hash": "3d2d12cf8593ec32b773f024d351f3c1"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/backend\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 1.5; en-us; sdk Build\/CUPCA",
    "event_signature": "60b5cb9cce42413b25db8476ae54e4246d63f16d",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "b0c5734e3267fae307a43bdf236b1c6b09949444",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "d227401356dbf11834ea71f41fab782a47e55e8d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 176,
    "payload_entropy": 5.1660099956543615,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "387145db7d2264939340742e7e3ab1840cb31764",
    "event_fingerprint": "0f925182dd1b5451889b0aa70cacfabaea24f064",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4617f7493afe33a1fc0e16514d66b372",
        "payload_hash": "67b25cc229b1b8087d84c4b902d04204",
        "path_pattern_hash": "3bc5c4fbb7fe3ed23eee2147536831d2"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/backend\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/4.0 (compatible; Dillo 3.0)\r\nAccept-Charset: utf",
    "event_signature": "4a241eeb5fa6af1d8475161c9fd5327389afe1f9",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "6d29a0a0b5852d2a8cb0afc62eac490dda061cfd",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "b8d945b65dbbe419d52ebdd552c143c70925f067",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 264,
    "payload_entropy": 5.3909821083430645,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f2120817aef55cdc3fb971cc24b7c215c45ae545",
    "event_fingerprint": "105c78c2d1eea37ce8e584579293da07f571db4d",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "bb377a0a44cc7226fb7b7276fef67dcc",
        "payload_hash": "f9f9ae9bf3239eba683a7c15009b8db2",
        "path_pattern_hash": "0b2570d8cc30161bb9d1f6c9f069b923"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/backend\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H873) AppleWebKit\/5",
    "event_signature": "7f1c13f8af84d952d9f542b11a807ca7fc805aa8",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "py",
    "http_ua_hash": "56bc29d1a2e4d360a827fca7c6a00b6dc7808202",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "63738cb5dcf9f3714e49039b7f1d4a7979e8e84b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 267,
    "payload_entropy": 5.3764779367450375,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "3a710b15b77db8ec7f68925d0bab94d29927997b",
    "event_fingerprint": "9b0dc01f50d12a5c5800f82039faf1061b53b636",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ffa5e1523d008fb050ecdda6f071f645",
        "payload_hash": "17eb3af39e18c139ad277f7108882ad4",
        "path_pattern_hash": "0b306e5ed377ac070d67be2675e6b336"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/settings\/base.py HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; Lenovo K8 Note) AppleWebKi",
    "event_signature": "bb252529d5408743ecec5d0dbcf276a0fd37480c",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_settings",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "properties",
    "http_ua_hash": "9ab98663edeccdd8065533078e706f4f4ee47fe8",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "7b82037305b05e4852e4a0d12fe52171d45b0128",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 283,
    "payload_entropy": 5.39743991173069,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c4693058dc208c02e185847b29ce9ab6710c784a",
    "event_fingerprint": "2486c706f76c95e8ec0e88eddbb5a4a1dd86f8dc",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c84132248af05b9a5363572f5f9fc8be",
        "payload_hash": "41916b3a8381bbe87a7362748bee7bf0",
        "path_pattern_hash": "f658d71e5b555b6dd4035cc9acb8e173"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; CPH1823 Build\/O1",
    "event_signature": "163edeea02ddbafbf7dfbb7c515469fe44129b1e",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "a9a14ed9a51a2ead540956d6c6cc8d45e4194499",
    "http_host_hash": "1b085ed71e3453f90e6fb0c42be126e42e28af3b",
    "http_target_hash": "16223ed774af363bfa3a19e07c4401628555ae7f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 265,
    "payload_entropy": 5.3917877673859005,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8200,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c4693058dc208c02e185847b29ce9ab6710c784a",
    "event_fingerprint": "e732588f4db574006b1f99ee7fc2d772520af6f9",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "beba3d5d57e33008dab2662a75c702d5",
        "payload_hash": "14d76911a6bd5c71e2e7f8775c3a4689",
        "path_pattern_hash": "9a59da8a4826d25b327ad6f6ccd7a0fe"
    },
    "target_context": {
        "dst_port": 8200,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/appsettings.json HTTP\/1.1\r\nHost: 62.3.50.33:8200\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0.1; GT-I9500) AppleWebKit\/",
    "event_signature": "5a6cbd3784326123a3597525422029fcb42a6e77",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}