{"ip":"34.19.127.180","exported_at":"2026-08-02T05:40:08+00:00","period_days":30,"metrics":{"events7d":4153,"distinct_ports":291,"distinct_classifications":22,"max_severity":10,"last_sensor_id":"paris-1","max_waf_score":40,"max_risk_score":83,"attack_stage":"recon","attack_chain_stage":"reconnaissance","threat_family":["scanner"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":40,"protocol":33,"novelty":15},"mitre_tactics":["TA0043"],"mitre_technique":"T1046","top_mitre_technique":"T1046","top_mitre_count":3704,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (46 protocoles \u00b7 5 min)","campaign_hint_fr":"Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)","confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":40,"protocol":33,"novelty":15,"risk_score":54,"correlation_boost":24},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["campagne_ports","scan_coordonn\u00e9","multi_protocol_correlation"],"correlation_flags_labels_fr":["Campagne multi-ports","Scan coordonn\u00e9","Multi-protocole corr\u00e9l\u00e9 (5 min)"],"confidence_pct":100,"confidence_hint_fr":"Corr\u00e9lation +24","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1046","SIGMA-net-port-scan","Beh Scan Burst","Beh Multi Port 60S"],"tags_summary":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"attack_vector":"port scan syn \u00b7 via HTTP:8040 \u00b7 (reconnaissance)","protocol_details":{"http_method":"GET","http_path":"\/","request_line":"GET \/ HTTP\/1.1","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","port":8040,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/ \u00b7 UA Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7)\u2026 \u00b7 HTTP:8040","evidence_snippet":"GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac","target_port_label":"8040 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 100 % \u2014 3 tag(s) WAF","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","classification_reason_label_fr":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +24 \u00b7 3 tag(s) WAF","payload_preview":"GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac"},"events":[{"id":14908535,"ip":"34.19.127.180","ts":"2026-08-01 09:04:03.000000","proto":"tcp","src_port":51200,"dst_port":8040,"service":"http","classification":"port_scan_syn","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00229468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c\u0022, \u0022http_host_hash\u0022: \u0022ef70bfd6e2bb5526cc8d8ebb452ffb26b3b43dba\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 216, \u0022payload_entropy\u0022: 5.393380860272721, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8040, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 54, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d3665fd44a919180f1d0d0a2cf675fd0bd40942e\u0022, \u0022event_fingerprint\u0022: \u00226b48df12f748b1fa3e8f3ce127735f04dd41e370\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0324\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Any-address SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0324\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 54, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00222994862c1f8176879ed381354c9dd245\u0022, \u0022payload_hash\u0022: \u0022e17b308f16d5c43caf9fccc3db255159\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8040, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 54}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022840c4b78765e6dcc8a172b7fd78afbf5a2f7a475\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8040, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8040 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228040 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 54, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 54, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8040, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 8040, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8040 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8040\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac\u0022, \u0022target_port_label\u0022: \u00228040 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +24 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228040\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8040, 8104, 8764, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 27, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_port_scan_slow\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8040","http_user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":8,"bytes_in":216},{"id":14908421,"ip":"34.19.127.180","ts":"2026-08-01 09:03:58.000000","proto":"tcp","src_port":34383,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.854808876796342, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u0022fbeab806823ea7dbe6877067c74b41bbbeb03f40\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022payload_hash\u0022: \u002225ca286a24a83bffb77136e29e3302f0\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\\u0003h\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\\u0003h\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\\u0003h\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002227cc1c3dcb716b11bc65d0c740145089c20e6457\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\\u0003h\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffdh\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffd\\u0003h\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\u0231d\/\ufffd\ufffd\ufffd\ufffd=\ufffdm\u019edQ\ufffd1\ufffd\ufffdB\ufffd]N\ufffdi\ufffdh\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 27, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"67625c3bd21c099689690498fb5b754e","tls_ja3":"769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908378,"ip":"34.19.127.180","ts":"2026-08-01 09:03:58.000000","proto":"tcp","src_port":29168,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 32, \u0022bytes_in\u0022: 351, \u0022payload_entropy\u0022: 5.365909426016082, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u0022c25b072c6f74464586342ab7e5ef608a48a5a2c3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022payload_hash\u0022: \u0022424b1132976b3cd2fd7782537c371bb9\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003+MK_Z}z\ufffd\\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\\u001f]X%\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003+MK_Z}z\ufffd\\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\\u001f]X%\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000;\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000k\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003+MK_Z}z\ufffd\\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\\u001f]X%\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221713a3f88e18e96059053e09eff7b5183c8feec2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003+MK_Z}z\ufffd\\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\\u001f]X%\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022ZV+MK_Z}z\ufffd\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS]X%\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003+MK_Z}z\ufffd\\u0018\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS\\u001f]X%\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022ZV+MK_Z}z\ufffd\ufffd\ufffdF?k\ufffd\u061c\ufffd\ufffd\u0777\ufffd\ufffd:\ufffdoS]X%\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 27, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"1efa91265313b0607d774cf0cdfebe64","tls_ja3":"771,49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-22-23-13,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":351},{"id":14908398,"ip":"34.19.127.180","ts":"2026-08-01 09:03:58.000000","proto":"tcp","src_port":12389,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.899952502681429, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u0022aebb1c8c0cf0c9e93f179c2ca502301c3c4948c8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022payload_hash\u0022: \u0022ecfca8de30d37b38923bd7d0cb2e2033\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022}, \u0022tls_ja3\u0022: \u0022770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022browser_like\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdJy\\u0016u*\\u001c*^}\ufffd\\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\\fYb\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdJy\\u0016u*\\u001c*^}\ufffd\\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\\fYb\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdJy\\u0016u*\\u001c*^}\ufffd\\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\\fYb\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fcb0804fdb4b7667bb7c1860b4f48bd2b98f0da5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdJy\\u0016u*\\u001c*^}\ufffd\\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\\fYb\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdJyu**^}\ufffdx\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffdYb\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdJy\\u0016u*\\u001c*^}\ufffd\\u001ax\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffd\\fYb\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdJyu**^}\ufffdx\ufffd\ufffd\u02d0\ufffd\ufffd\u018c\ufffd\ufffd\ufffd\ufffdQ-\ufffdYb\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 27, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"f9b8f0bb9fb9f179320b2833fbe71c48","tls_ja3":"770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908318,"ip":"34.19.127.180","ts":"2026-08-01 09:03:57.000000","proto":"tcp","src_port":34172,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00228946c511138b12399488b08a5f1b3ae2\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022bytes_in\u0022: 1474, \u0022payload_entropy\u0022: 7.76402089896983, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022eb2a46ead43c63344da5490801925b4471b834a8\u0022, \u0022event_fingerprint\u0022: \u002211ec28d70ecdf5d32404d9fcfe279bd8241e556f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00228946c511138b12399488b08a5f1b3ae2\u0022, \u0022payload_hash\u0022: \u00229590cab751d712127d73b4cd564ac12d\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000.\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0005\\u0001\\u0005\\u0002\\u0005\\u0003\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0003\\u0001\\u0003\\u0002\\u0003\\u0003\\u0002\\u0001\\u0002\\u0002\\u0002\\u0003\\u0000\\n\\u0000\\u0018\\u0000\\u0016\\u0000\\u0017\\u0000\\u0019\\u0000\\u0018\\u0000\\u001d\\u0000\\u001e\\u0001\\u0000\\u0001\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0011\ufffdc\ufffd\\u00003\\u0004\ufffd\\u0004\ufffd\\u0000\\u001d\\u0000 (?\\u0011\\u001f$\ufffdwq\ufffd\\u001b\\u0012,\ufffd\ufffd\ufffd\\u001f\ufffd.\\u0003\\u0011\u07f6{(\ufffdKe\ufffd%Ot\\u0011\ufffd\\u0004\ufffd\ufffdp\u0348\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227a3bc76dad7706d449efbd4bb3ce67a50ec114e0\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022tls_ja3\u0022: \u00228946c511138b12399488b08a5f1b3ae2\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjm\ufffd~\ufffdHs\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$p\ufffd\ufffd \ufffd\ufffdH+#\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\ufffdr\ufffd\ufffdP\ufffdHB\\nf\\r\\n62.3.50.33#\\r0\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022tls_ja3\u0022: \u00228946c511138b12399488b08a5f1b3ae2\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjm\ufffd~\ufffdHs\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$p\ufffd\ufffd \ufffd\ufffdH+#\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\ufffdr\ufffd\ufffdP\ufffdHB\\nf\\r\\n62.3.50.33#\\r0\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"8946c511138b12399488b08a5f1b3ae2","tls_ja3":"771,4865-4866-4867-4868-4869,0-11-35-13-10-25497-32883,23-25-24-29-30-256-257-258-259-260-4588,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022]","anomalies":"[]","severity":5,"bytes_in":1474},{"id":14908334,"ip":"34.19.127.180","ts":"2026-08-01 09:03:57.000000","proto":"tcp","src_port":49322,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022bytes_in\u0022: 1481, \u0022payload_entropy\u0022: 7.7173996377811465, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022eb2a46ead43c63344da5490801925b4471b834a8\u0022, \u0022event_fingerprint\u0022: \u0022adbdb758a163d56bf5128527c97bb590e97efb44\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022payload_hash\u0022: \u002298462db1453e6bfe8c61191e22ec8d2e\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u0015\ufffd\ufffdU%aw\ufffd\u003C\ufffd\\u0018\ufffd7c\ufffd3\ufffd\ufffdm\\u000b\u003C\ufffd\ufffd!Ci\ufffd\u003E\\\\R-L ).\ufffdU\ufffd*\\u0000]\ufffdO\ufffd\ufffd\\u0017L\ufffd\u003C\ufffdq\ufffd|\\u000e\ufffd\ufffd5\ufffdz\ufffdT\\u000f\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u0015\ufffd\ufffdU%aw\ufffd\u003C\ufffd\\u0018\ufffd7c\ufffd3\ufffd\ufffdm\\u000b\u003C\ufffd\ufffd!Ci\ufffd\u003E\\\\R-L ).\ufffdU\ufffd*\\u0000]\ufffdO\ufffd\ufffd\\u0017L\ufffd\u003C\ufffdq\ufffd|\\u000e\ufffd\ufffd5\ufffdz\ufffdT\\u000f\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0001\\u0000\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000*\\u0000(\\t\\u0005\\t\\u0006\\t\\u0004\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\u001a\\b\\u001b\\b\\u001c\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\ufffdp\ufffd;\ufffd\\r\\u0006\ufffdx\\u0001\ufffd\ufffd\\u0001\\u0001\ufffd \\u0015\\u0006u,B\ufffdf\u0471Z$\\u0007%~I\ufffd\u0026\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u0015\ufffd\ufffdU%aw\ufffd\u003C\ufffd\\u0018\ufffd7c\ufffd3\ufffd\ufffdm\\u000b\u003C\ufffd\ufffd!Ci\ufffd\u003E\\\\R-L ).\ufffdU\ufffd*\\u0000]\ufffdO\ufffd\ufffd\\u0017L\ufffd\u003C\ufffdq\ufffd|\\u000e\ufffd\ufffd5\ufffdz\ufffdT\\u000f\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225b070530627cc19da5631ccaddd3f7d072ed4701\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u0015\ufffd\ufffdU%aw\ufffd\u003C\ufffd\\u0018\ufffd7c\ufffd3\ufffd\ufffdm\\u000b\u003C\ufffd\ufffd!Ci\ufffd\u003E\\\\R-L ).\ufffdU\ufffd*\\u0000]\ufffdO\ufffd\ufffd\\u0017L\ufffd\u003C\ufffdq\ufffd|\\u000e\ufffd\ufffd5\ufffdz\ufffdT\\u000f\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022tls_ja3\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdU%aw\ufffd\u003C\ufffd\ufffd7c\ufffd3\ufffd\ufffdm\u003C\ufffd\ufffd!Ci\ufffd\u003E\\\\R-L ).\ufffdU\ufffd*]\ufffdO\ufffd\ufffdL\ufffd\u003C\ufffdq\ufffd|\ufffd\ufffd5\ufffdz\ufffdT\ufffd\\nm\\r\\n62.3.50.33\\n\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u0015\ufffd\ufffdU%aw\ufffd\u003C\ufffd\\u0018\ufffd7c\ufffd3\ufffd\ufffdm\\u000b\u003C\ufffd\ufffd!Ci\ufffd\u003E\\\\R-L ).\ufffdU\ufffd*\\u0000]\ufffdO\ufffd\ufffd\\u0017L\ufffd\u003C\ufffdq\ufffd|\\u000e\ufffd\ufffd5\ufffdz\ufffdT\\u000f\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022tls_ja3\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdU%aw\ufffd\u003C\ufffd\ufffd7c\ufffd3\ufffd\ufffdm\u003C\ufffd\ufffd!Ci\ufffd\u003E\\\\R-L ).\ufffdU\ufffd*]\ufffdO\ufffd\ufffdL\ufffd\u003C\ufffdq\ufffd|\ufffd\ufffd5\ufffdz\ufffdT\ufffd\\nm\\r\\n62.3.50.33\\n\ufffd\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"de8c366fbb06bedcd7b86ddda1addac6","tls_ja3":"771,4865-4866-4867-4868-4869,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022]","anomalies":"[]","severity":5,"bytes_in":1481},{"id":14908355,"ip":"34.19.127.180","ts":"2026-08-01 09:03:57.000000","proto":"tcp","src_port":4104,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 32, \u0022bytes_in\u0022: 1695, \u0022payload_entropy\u0022: 7.599532275182358, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u0022ea7e29b209fc2a99a733eb7a953aff2d8c532df1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022payload_hash\u0022: \u002241085633cf921a59077848264d40a653\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\\u0015p\\u0014O\ufffd\ufffd\ufffd\\u0015\u02a8\\f\\u001e\\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\\u0000\ufffd\u021fb\ufffd\\\u0022?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\\u0015p\\u0014O\ufffd\ufffd\ufffd\\u0015\u02a8\\f\\u001e\\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\\u0000\ufffd\u021fb\ufffd\\\u0022?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\\u0015p\\u0014O\ufffd\ufffd\ufffd\\u0015\u02a8\\f\\u001e\\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\\u0000\ufffd\u021fb\ufffd\\\u0022?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227ad63d8382ec2ff697c5b32b837ff4691535e84e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\\u0015p\\u0014O\ufffd\ufffd\ufffd\\u0015\u02a8\\f\\u001e\\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\\u0000\ufffd\u021fb\ufffd\\\u0022?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022tls_ja3\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffdpO\ufffd\ufffd\ufffd\u02a8\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\ufffd\u021fb\ufffd\\\u0022?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffd\\u0015p\\u0014O\ufffd\ufffd\ufffd\\u0015\u02a8\\f\\u001e\\u0005\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\\u0000\ufffd\u021fb\ufffd\\\u0022?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022tls_ja3\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0333!b\ufffd}\ufffdpO\ufffd\ufffd\ufffd\u02a8\ufffd7\ufffd\ufffd\ufffdq\ufffd \ufffd^\ufffd\u021fb\ufffd\\\u0022?\u0674\ufffd \ufffd\ufffd\ufffd{\ufffd\ufffdb\ufffd7]+w\ufffd\ufffd`\ufffd\ufffds\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"3947c3d16bc8cd21ac2296ef9eea028d","tls_ja3":"771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":1695},{"id":14908268,"ip":"34.19.127.180","ts":"2026-08-01 09:03:56.000000","proto":"tcp","src_port":27080,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.879896645513846, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u0022aebb1c8c0cf0c9e93f179c2ca502301c3c4948c8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022payload_hash\u0022: \u00222f6fe24527422867a1fc839cf97e86c3\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022}, \u0022tls_ja3\u0022: \u0022770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022browser_like\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd|\ufffdS\\u0014\ufffds\\u0012\ufffd\\u0019\ufffd%\ufffd\ufffd\ufffd\\u0006u\\u001f\ufffd\ufffd\\u001f^\\u001e\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd|\ufffdS\\u0014\ufffds\\u0012\ufffd\\u0019\ufffd%\ufffd\ufffd\ufffd\\u0006u\\u001f\ufffd\ufffd\\u001f^\\u001e\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd|\ufffdS\\u0014\ufffds\\u0012\ufffd\\u0019\ufffd%\ufffd\ufffd\ufffd\\u0006u\\u001f\ufffd\ufffd\\u001f^\\u001e\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f6f2a46bb5aaa6e31f1a7299cb60c7625031476b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd|\ufffdS\\u0014\ufffds\\u0012\ufffd\\u0019\ufffd%\ufffd\ufffd\ufffd\\u0006u\\u001f\ufffd\ufffd\\u001f^\\u001e\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd|\ufffdS\ufffds\ufffd\ufffd%\ufffd\ufffd\ufffdu\ufffd\ufffd^F\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd|\ufffdS\\u0014\ufffds\\u0012\ufffd\\u0019\ufffd%\ufffd\ufffd\ufffd\\u0006u\\u001f\ufffd\ufffd\\u001f^\\u001e\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffdW\ufffd:\ufffd\ufffd|\ufffdS\ufffds\ufffd\ufffd%\ufffd\ufffd\ufffdu\ufffd\ufffd^F\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"f9b8f0bb9fb9f179320b2833fbe71c48","tls_ja3":"770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908287,"ip":"34.19.127.180","ts":"2026-08-01 09:03:56.000000","proto":"tcp","src_port":5242,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 102, \u0022bytes_in\u0022: 899, \u0022payload_entropy\u0022: 5.720055676364848, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u00225e42777f53c76cc97b7e6c8807d1ef4c2e33d77e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022payload_hash\u0022: \u002203705e2812a4777c9a1465e7c7bb9623\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u001a\\u0000\\u001b\\u0000\\u001e\\u0000\\u001f\\u0000 \\u0000!\\u0000\\\u0022\\u0000#\\u0000$\\u0000%\\u0000\u0026\\u0000\u0027\\u0000(\\u0000)\\u0000*\\u0000+\\u0000,\\u0000-\\u0000.\\u0000\/\\u00000\\u00001\\u00002\\u00003\\u00004\\u00005\\u00006\\u00007\\u00008\\u00009\\u0000:\\u0000;\\u0000\u003C\\u0000=\\u0000\u003E\\u0000?\\u0000@\\u0000A\\u0000B\\u0000C\\u0000D\\u0000E\\u0000F\\u0000g\\u0000h\\u0000i\\u0000j\\u0000k\\u0000l\\u0000m\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c7a6deab36c72f4f98d25fa0c6b374175e55e0ad\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022~zjm\ufffd~\ufffdHs\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$p\ufffd\ufffd \ufffd\ufffdH+#\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\ufffdr\ufffd\ufffdP\ufffdHB\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffd~\ufffdH\\u0014s\\u0000\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$\\u0000\\u001cp\ufffd\ufffd \ufffd\ufffdH+#\\u0003\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\\u0017\ufffdr\ufffd\ufffdP\ufffdHB\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022~zjm\ufffd~\ufffdHs\u06e9\ufffdIm?\ufffd\ufffd\ufffd\ufffd\\t\u0751j\ufffd\u0026$p\ufffd\ufffd \ufffd\ufffdH+#\ufffd\ufffd\ufffdLmV.\ufffd\ufffd\ufffd\u07d1\ufffd=)$\ufffdr\ufffd\ufffdP\ufffdHB\ufffd\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"4ae33de1ad93956213297c61748ec996","tls_ja3":"771,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-103-104-105-106-107-108-109-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-4870-4871-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-49332-49333-49408-49409-49410-49411-49412-49413-49414-52392-52393-52394-52395-52396-52397-52398-53249-53250-53251-53253-255,0-11-35-13-10,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":899},{"id":14908303,"ip":"34.19.127.180","ts":"2026-08-01 09:03:56.000000","proto":"tcp","src_port":55060,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 32, \u0022bytes_in\u0022: 351, \u0022payload_entropy\u0022: 5.351628730842958, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u0022c25b072c6f74464586342ab7e5ef608a48a5a2c3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022payload_hash\u0022: \u0022a90062fa21bb7fab7f607cab61911bf5\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\\\\L\\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\\u0012\ufffdQ\ufffdp\ufffd\ufffd\u0026\ufffd\ufffd\ufffdz\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\\\\L\\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\\u0012\ufffdQ\ufffdp\ufffd\ufffd\u0026\ufffd\ufffd\ufffdz\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000;\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000k\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\\\\L\\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\\u0012\ufffdQ\ufffdp\ufffd\ufffd\u0026\ufffd\ufffd\ufffdz\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cf9238637e2b888d83d23a6a33f603e1b0637087\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\\\\L\\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\\u0012\ufffdQ\ufffdp\ufffd\ufffd\u0026\ufffd\ufffd\ufffdz\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022ZV\\\\L\ufffd\ufffd6\ufffd\ufffduxV\ufffd\ufffd\ufffdz\ufffd\ufffd{\ufffd\ufffdQ\ufffdp\ufffd\ufffd\u0026\ufffd\ufffd\ufffdz\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 24}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +24\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\\\\L\\u0011\ufffd\ufffd6\ufffd\ufffduxV\ufffd\\u000b\ufffd\ufffdz\ufffd\ufffd{\ufffd\\u0012\ufffdQ\ufffdp\ufffd\ufffd\u0026\ufffd\ufffd\ufffdz\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022ZV\\\\L\ufffd\ufffd6\ufffd\ufffduxV\ufffd\ufffd\ufffdz\ufffd\ufffd{\ufffd\ufffdQ\ufffdp\ufffd\ufffd\u0026\ufffd\ufffd\ufffdz\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 24, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"1efa91265313b0607d774cf0cdfebe64","tls_ja3":"771,49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-22-23-13,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":351},{"id":14908210,"ip":"34.19.127.180","ts":"2026-08-01 09:03:55.000000","proto":"tcp","src_port":44162,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: null, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 11, \u0022payload_entropy\u0022: 2.2221915755066783, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 23.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 23.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002218bc19c3c9c826abb4bc2f2aa9f427077485a572\u0022, \u0022event_fingerprint\u0022: \u0022a6f2ac07f40742e1f9b0fb17bf4ebb71ebcf5956\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 23.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002255b6c6b63391f7a244877208a3a6144c\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225cbda4e4e92df7608f23466cb60e677116802835\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 23.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.82, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":5,"bytes_in":11},{"id":14908226,"ip":"34.19.127.180","ts":"2026-08-01 09:03:55.000000","proto":"tcp","src_port":47871,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022e53406bbb3118b0c8a662f6717ac159d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 102, \u0022bytes_in\u0022: 899, \u0022payload_entropy\u0022: 5.74427253697689, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u0022a69c3559900973b5d4076fa87cb72834ab3e9971\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022e53406bbb3118b0c8a662f6717ac159d\u0022, \u0022payload_hash\u0022: \u0022699cc9664b1f380d08a9f23ed07cf10e\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffd|\ufffdH\\u0012w\\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\\u000b\u0751h\ufffd\u0026$\ufffd\\u001ep\ufffd\ufffd \ufffd\ufffdH)%\\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\\u0015\ufffdr\ufffd\ufffdR\ufffdH@\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffd|\ufffdH\\u0012w\\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\\u000b\u0751h\ufffd\u0026$\ufffd\\u001ep\ufffd\ufffd \ufffd\ufffdH)%\\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\\u0015\ufffdr\ufffd\ufffdR\ufffdH@\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u001a\\u0000\\u001b\\u0000\\u001e\\u0000\\u001f\\u0000 \\u0000!\\u0000\\\u0022\\u0000#\\u0000$\\u0000%\\u0000\u0026\\u0000\u0027\\u0000(\\u0000)\\u0000*\\u0000+\\u0000,\\u0000-\\u0000.\\u0000\/\\u00000\\u00001\\u00002\\u00003\\u00004\\u00005\\u00006\\u00007\\u00008\\u00009\\u0000:\\u0000;\\u0000\u003C\\u0000=\\u0000\u003E\\u0000?\\u0000@\\u0000A\\u0000B\\u0000C\\u0000D\\u0000E\\u0000F\\u0000g\\u0000h\\u0000i\\u0000j\\u0000k\\u0000l\\u0000m\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffd|\ufffdH\\u0012w\\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\\u000b\u0751h\ufffd\u0026$\ufffd\\u001ep\ufffd\ufffd \ufffd\ufffdH)%\\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\\u0015\ufffdr\ufffd\ufffdR\ufffdH@\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e1406fa6ca78f9339146bd84d07444a87dc126b2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffd|\ufffdH\\u0012w\\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\\u000b\u0751h\ufffd\u0026$\ufffd\\u001ep\ufffd\ufffd \ufffd\ufffdH)%\\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\\u0015\ufffdr\ufffd\ufffdR\ufffdH@\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u0022e53406bbb3118b0c8a662f6717ac159d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022~zjm\ufffd|\ufffdHw\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\u0751h\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH)%\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\ufffdr\ufffd\ufffdR\ufffdH@\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffd|\ufffdH\\u0012w\\u0000\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\\u000b\u0751h\ufffd\u0026$\ufffd\\u001ep\ufffd\ufffd \ufffd\ufffdH)%\\u0003\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\\u0015\ufffdr\ufffd\ufffdR\ufffdH@\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u0022e53406bbb3118b0c8a662f6717ac159d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022~zjm\ufffd|\ufffdHw\u06e7\ufffdIm=\ufffd\ufffd\ufffd\ufffd\u0751h\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH)%\u06fe\ufffdLmT0\ufffd\ufffd\ufffd\u07d1?)$\ufffdr\ufffd\ufffdR\ufffdH@\ufffd\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.82, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"e53406bbb3118b0c8a662f6717ac159d","tls_ja3":"769,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-103-104-105-106-107-108-109-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-4870-4871-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-49332-49333-49408-49409-49410-49411-49412-49413-49414-52392-52393-52394-52395-52396-52397-52398-53249-53250-53251-53253-255,0-11-35-13-10,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":899},{"id":14908242,"ip":"34.19.127.180","ts":"2026-08-01 09:03:55.000000","proto":"tcp","src_port":64724,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.844288569200092, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u0022fbeab806823ea7dbe6877067c74b41bbbeb03f40\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022payload_hash\u0022: \u00223bd6f99f9ef19af1598b84ea812eca5c\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\\f\ufffd\ufffd\\f\u0026\ufffd\ufffd\ufffd\ufffdj\\u0004D\ufffdY=\ufffd\ufffdW\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\\f\ufffd\ufffd\\f\u0026\ufffd\ufffd\ufffd\ufffdj\\u0004D\ufffdY=\ufffd\ufffdW\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\\f\ufffd\ufffd\\f\u0026\ufffd\ufffd\ufffd\ufffdj\\u0004D\ufffdY=\ufffd\ufffdW\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fa605104acae0a33961512543bbb3745dd8e5527\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\\f\ufffd\ufffd\\f\u0026\ufffd\ufffd\ufffd\ufffdj\\u0004D\ufffdY=\ufffd\ufffdW\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffdjD\ufffdY=\ufffd\ufffdW\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\\f\ufffd\ufffd\\f\u0026\ufffd\ufffd\ufffd\ufffdj\\u0004D\ufffdY=\ufffd\ufffdW\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd:\ufffdW\ufffdu\ufffd1@b\ufffd\ufffd\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffdjD\ufffdY=\ufffd\ufffdW\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.81, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"67625c3bd21c099689690498fb5b754e","tls_ja3":"769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908255,"ip":"34.19.127.180","ts":"2026-08-01 09:03:55.000000","proto":"tcp","src_port":16828,"dst_port":9054,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221196e3b1fa255a444a88617c122e45a5\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 102, \u0022bytes_in\u0022: 899, \u0022payload_entropy\u0022: 5.737295878392577, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002214daed23e9b9240911a6da19b24dd2b1610dc182\u0022, \u0022event_fingerprint\u0022: \u002288a610d079aebae8a477000cd8603c110effae4a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221196e3b1fa255a444a88617c122e45a5\u0022, \u0022payload_hash\u0022: \u00222d86cf14143f032f68932d1457964fc8\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffd}\ufffdH\\u0013w\\u0000\u06e8\ufffdIm\u003E\ufffd\ufffd\ufffd\ufffd\\n\u0751i\ufffd\u0026$\ufffd\\u001dp\ufffd\ufffd \ufffd\ufffdH*$\\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd\u003E)$\\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffd}\ufffdH\\u0013w\\u0000\u06e8\ufffdIm\u003E\ufffd\ufffd\ufffd\ufffd\\n\u0751i\ufffd\u0026$\ufffd\\u001dp\ufffd\ufffd \ufffd\ufffdH*$\\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd\u003E)$\\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u001a\\u0000\\u001b\\u0000\\u001e\\u0000\\u001f\\u0000 \\u0000!\\u0000\\\u0022\\u0000#\\u0000$\\u0000%\\u0000\u0026\\u0000\u0027\\u0000(\\u0000)\\u0000*\\u0000+\\u0000,\\u0000-\\u0000.\\u0000\/\\u00000\\u00001\\u00002\\u00003\\u00004\\u00005\\u00006\\u00007\\u00008\\u00009\\u0000:\\u0000;\\u0000\u003C\\u0000=\\u0000\u003E\\u0000?\\u0000@\\u0000A\\u0000B\\u0000C\\u0000D\\u0000E\\u0000F\\u0000g\\u0000h\\u0000i\\u0000j\\u0000k\\u0000l\\u0000m\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffd}\ufffdH\\u0013w\\u0000\u06e8\ufffdIm\u003E\ufffd\ufffd\ufffd\ufffd\\n\u0751i\ufffd\u0026$\ufffd\\u001dp\ufffd\ufffd \ufffd\ufffdH*$\\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd\u003E)$\\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dbaa74553cd7a8621f6af02832650924310aa512\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffd}\ufffdH\\u0013w\\u0000\u06e8\ufffdIm\u003E\ufffd\ufffd\ufffd\ufffd\\n\u0751i\ufffd\u0026$\ufffd\\u001dp\ufffd\ufffd \ufffd\ufffdH*$\\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd\u003E)$\\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00221196e3b1fa255a444a88617c122e45a5\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022~zjm\ufffd}\ufffdHw\u06e8\ufffdIm\u003E\ufffd\ufffd\ufffd\ufffd\\n\u0751i\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH*$\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd\u003E)$\ufffdr\ufffd\ufffdQ\ufffdHA\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffd}\ufffdH\\u0013w\\u0000\u06e8\ufffdIm\u003E\ufffd\ufffd\ufffd\ufffd\\n\u0751i\ufffd\u0026$\ufffd\\u001dp\ufffd\ufffd \ufffd\ufffdH*$\\u0003\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd\u003E)$\\u0016\ufffdr\ufffd\ufffdQ\ufffdHA\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00221196e3b1fa255a444a88617c122e45a5\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9054, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022~zjm\ufffd}\ufffdHw\u06e8\ufffdIm\u003E\ufffd\ufffd\ufffd\ufffd\\n\u0751i\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH*$\u06ff\ufffdLmU\/\ufffd\ufffd\ufffd\u07d1\ufffd\u003E)$\ufffdr\ufffd\ufffdQ\ufffdHA\ufffd\u0022, \u0022target_port_label\u0022: \u00229054 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.61, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"1196e3b1fa255a444a88617c122e45a5","tls_ja3":"770,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-103-104-105-106-107-108-109-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-4870-4871-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-49332-49333-49408-49409-49410-49411-49412-49413-49414-52392-52393-52394-52395-52396-52397-52398-53249-53250-53251-53253-255,0-11-35-13-10,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":899},{"id":14908187,"ip":"34.19.127.180","ts":"2026-08-01 09:03:54.000000","proto":"tcp","src_port":48503,"dst_port":9054,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222f4e07a59138df32e3fbb8195c3054bc42d757e7\u0022, \u0022event_fingerprint\u0022: \u00220e748a364441305f623548cd87ecfbe60d61dc11\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c74aebc91d81f35e3684b594cc4221aa0cdb76d9\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 9054}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 9054}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00229054\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.81, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":14908191,"ip":"34.19.127.180","ts":"2026-08-01 09:03:54.000000","proto":"tcp","src_port":60318,"dst_port":9054,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 54, \u0022payload_entropy\u0022: 3.705848099200768, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9054, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222f4e07a59138df32e3fbb8195c3054bc42d757e7\u0022, \u0022event_fingerprint\u0022: \u00220e748a364441305f623548cd87ecfbe60d61dc11\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d7b673fcc625b3fe0c577928300be63e\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9054, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022request_sample\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022payload_snippet\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022payload_snippet\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b24240df73f04fdb986ba1a5254fbc8e4f808253\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022port\u0022: 9054}, \u0022evidence_snippet\u0022: \u0022\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 9054 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229054\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 9054, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022port\u0022: 9054}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 9054 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00229054\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229054\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 14, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043, 9054], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.82, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":54},{"id":14908127,"ip":"34.19.127.180","ts":"2026-08-01 09:03:53.000000","proto":"tcp","src_port":13373,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 32, \u0022bytes_in\u0022: 351, \u0022payload_entropy\u0022: 5.397304155385466, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u0022144b1e52aa86a58ec6c4d4cd06d7794a2ddc7c5a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022payload_hash\u0022: \u0022b821aa632782d0b9a3a07fc1ccbccbdb\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003U\u00f6\ufffd\u0690\\u0019\u022d]\ufffd\\u000e\ufffd|\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\\u0007\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003U\u00f6\ufffd\u0690\\u0019\u022d]\ufffd\\u000e\ufffd|\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\\u0007\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000;\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000k\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003U\u00f6\ufffd\u0690\\u0019\u022d]\ufffd\\u000e\ufffd|\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\\u0007\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d039fbf9ed635b0d90ebc2815c4cc1c82ff58fb8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003U\u00f6\ufffd\u0690\\u0019\u022d]\ufffd\\u000e\ufffd|\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\\u0007\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022ZVU\u00f6\ufffd\u0690\u022d]\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003U\u00f6\ufffd\u0690\\u0019\u022d]\ufffd\\u000e\ufffd|\ufffd\ufffd\ufffd\\u0011\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\\u0007\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022ZVU\u00f6\ufffd\u0690\u022d]\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffd(J\ufffdY\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.8, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"1efa91265313b0607d774cf0cdfebe64","tls_ja3":"771,49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-22-23-13,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":351},{"id":14908139,"ip":"34.19.127.180","ts":"2026-08-01 09:03:53.000000","proto":"tcp","src_port":4179,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.867897414256075, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u002267576e2e5639b025b861945e60b6b4ebeb68da22\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022payload_hash\u0022: \u0022eb5aab628b87dc54f3556d4d7b8b6b21\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022}, \u0022tls_ja3\u0022: \u0022770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022browser_like\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002Ir*i\ufffd\ufffd\ufffd\\tR\ufffdV\ufffd\ufffdP\ufffdNE\\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi\u003Cc\ufffd1u\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002Ir*i\ufffd\ufffd\ufffd\\tR\ufffdV\ufffd\ufffdP\ufffdNE\\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi\u003Cc\ufffd1u\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002Ir*i\ufffd\ufffd\ufffd\\tR\ufffdV\ufffd\ufffdP\ufffdNE\\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi\u003Cc\ufffd1u\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a2614a342a7488bce5072b7515a89378e741c9fd\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002Ir*i\ufffd\ufffd\ufffd\\tR\ufffdV\ufffd\ufffdP\ufffdNE\\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi\u003Cc\ufffd1u\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdIr*i\ufffd\ufffd\ufffd\\tR\ufffdV\ufffd\ufffdP\ufffdNE3\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi\u003Cc\ufffd1uF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002Ir*i\ufffd\ufffd\ufffd\\tR\ufffdV\ufffd\ufffdP\ufffdNE\\u00023\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi\u003Cc\ufffd1u\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdIr*i\ufffd\ufffd\ufffd\\tR\ufffdV\ufffd\ufffdP\ufffdNE3\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffdi\u003Cc\ufffd1uF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.6, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"f9b8f0bb9fb9f179320b2833fbe71c48","tls_ja3":"770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908153,"ip":"34.19.127.180","ts":"2026-08-01 09:03:53.000000","proto":"tcp","src_port":25015,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.777610162485902, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u0022d1e634537db6a515f9c0042999a3a84eb4b27fad\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022payload_hash\u0022: \u00224af1d18e0a3ba653cb1e1ee1497082f8\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\f\ufffd\\u0018XV\ufffd\ufffdX\\u001e7\\u0002\\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd\\u001b\\t\\u001c\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\f\ufffd\\u0018XV\ufffd\ufffdX\\u001e7\\u0002\\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd\\u001b\\t\\u001c\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\f\ufffd\\u0018XV\ufffd\ufffdX\\u001e7\\u0002\\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd\\u001b\\t\\u001c\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222c471b77628cd5653e1a625011f48d666cb5cf01\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\f\ufffd\\u0018XV\ufffd\ufffdX\\u001e7\\u0002\\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd\\u001b\\t\\u001c\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdXV\ufffd\ufffdX7@21\ufffd\ufffdx2f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\tF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\f\ufffd\\u0018XV\ufffd\ufffdX\\u001e7\\u0002\\u001c@21\ufffd\ufffdx2f\ufffd\ufffd\\u0010\ufffd\ufffd\ufffd\ufffd\\u001b\\t\\u001c\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdXV\ufffd\ufffdX7@21\ufffd\ufffdx2f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\tF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.6, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"67625c3bd21c099689690498fb5b754e","tls_ja3":"769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908085,"ip":"34.19.127.180","ts":"2026-08-01 09:03:52.000000","proto":"tcp","src_port":50052,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022329b5d847afc81655969061add3bac67\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022bytes_in\u0022: 1474, \u0022payload_entropy\u0022: 7.748770210305192, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002269e949c993568d768a56525f0ff23516934c3048\u0022, \u0022event_fingerprint\u0022: \u00221c674a2d94f17c94fd405b75588cfc294fb305db\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022329b5d847afc81655969061add3bac67\u0022, \u0022payload_hash\u0022: \u002266ee02536b34ba35fa4cbde088a638ff\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdy\ufffdH\\u000fo\\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd\u0026$\ufffd\\u0019p\ufffd\ufffd \ufffd\ufffdH\u0026 \\u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\\u0012\ufffdr\ufffd\ufffdM\ufffdH=\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdy\ufffdH\\u000fo\\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd\u0026$\ufffd\\u0019p\ufffd\ufffd \ufffd\ufffdH\u0026 \\u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\\u0012\ufffdr\ufffd\ufffdM\ufffdH=\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000.\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0005\\u0001\\u0005\\u0002\\u0005\\u0003\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0003\\u0001\\u0003\\u0002\\u0003\\u0003\\u0002\\u0001\\u0002\\u0002\\u0002\\u0003\\u0000\\n\\u0000\\u0018\\u0000\\u0016\\u0000\\u0017\\u0000\\u0019\\u0000\\u0018\\u0000\\u001d\\u0000\\u001e\\u0001\\u0000\\u0001\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0011\ufffdc\ufffd\\u00003\\u0004\ufffd\\u0004\ufffd\\u0000\\u001d\\u0000 \ufffd~\ufffd\ufffd\ufffd\ufffdQ\ufffd0\ufffd\\u0001\u003Cc\\u001d\ufffd4\ufffd\\u0004\ufffd\ufffd$\ufffd\\u0012\ufffd\\\u0022\ufffd~\\u0006\\u0011\ufffd\\u0004\ufffd\\f\ufffde\ufffd0\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdy\ufffdH\\u000fo\\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd\u0026$\ufffd\\u0019p\ufffd\ufffd \ufffd\ufffdH\u0026 \\u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\\u0012\ufffdr\ufffd\ufffdM\ufffdH=\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002260cdd9cceaff961bb15d28d5ce0d2d77bfeda718\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdy\ufffdH\\u000fo\\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd\u0026$\ufffd\\u0019p\ufffd\ufffd \ufffd\ufffdH\u0026 \\u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\\u0012\ufffdr\ufffd\ufffdM\ufffdH=\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022329b5d847afc81655969061add3bac67\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjm\ufffdy\ufffdHo\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH\u0026 \u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\ufffdr\ufffd\ufffdM\ufffdH=\\nf\\r\\n62.3.50.33#\\r0\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdy\ufffdH\\u000fo\\u0000\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd\u0026$\ufffd\\u0019p\ufffd\ufffd \ufffd\ufffdH\u0026 \\u0003\u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\\u0012\ufffdr\ufffd\ufffdM\ufffdH=\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022329b5d847afc81655969061add3bac67\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjm\ufffdy\ufffdHo\u06e4\ufffdIm:p\ufffd\ufffd\ufffd\ufffd\u0711e\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH\u0026 \u06fb\ufffdLmQ#\ufffd\ufffd\ufffd\u07d1|2)$\ufffdr\ufffd\ufffdM\ufffdH=\\nf\\r\\n62.3.50.33#\\r0\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.81, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"329b5d847afc81655969061add3bac67","tls_ja3":"771,4865-4866-4867-4868-4869,0-11-35-13-10-25497-42061,23-25-24-29-30-256-257-258-259-260-4588,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022]","anomalies":"[]","severity":5,"bytes_in":1474},{"id":14908101,"ip":"34.19.127.180","ts":"2026-08-01 09:03:52.000000","proto":"tcp","src_port":3195,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022bytes_in\u0022: 1481, \u0022payload_entropy\u0022: 7.696079416217483, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002269e949c993568d768a56525f0ff23516934c3048\u0022, \u0022event_fingerprint\u0022: \u002242484e6fcde4b781b8c17f85f63e24dfe546394d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022payload_hash\u0022: \u00229084c839e056fc714eef049aecff2afc\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffda4\u0027_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\\u0014\ufffd;m\ufffd\\u001b \ufffd\\n\ufffd\ufffdn8\u059a\ufffd\\u001d\ufffd\ufffd\\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\\rO\ufffd\ufffd\ufffd\\u0011\ufffds3H\\u0000{\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffda4\u0027_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\\u0014\ufffd;m\ufffd\\u001b \ufffd\\n\ufffd\ufffdn8\u059a\ufffd\\u001d\ufffd\ufffd\\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\\rO\ufffd\ufffd\ufffd\\u0011\ufffds3H\\u0000{\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0001\\u0000\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000*\\u0000(\\t\\u0005\\t\\u0006\\t\\u0004\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\u001a\\b\\u001b\\b\\u001c\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\ufffd\\u0014~\u04d0\ufffd\ufffd\\u00036\ufffd\ufffdte\ufffd\ufffd\\u001a\ufffdgX\u00dd\ufffdh\ufffd\ufffd\\u0001\ufffd\ufffd4\\u000e\ufffd\ufffd\ufffdb\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffda4\u0027_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\\u0014\ufffd;m\ufffd\\u001b \ufffd\\n\ufffd\ufffdn8\u059a\ufffd\\u001d\ufffd\ufffd\\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\\rO\ufffd\ufffd\ufffd\\u0011\ufffds3H\\u0000{\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223fc355e48bacd58fc9483f56e5e30514a1500499\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffda4\u0027_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\\u0014\ufffd;m\ufffd\\u001b \ufffd\\n\ufffd\ufffdn8\u059a\ufffd\\u001d\ufffd\ufffd\\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\\rO\ufffd\ufffd\ufffd\\u0011\ufffds3H\\u0000{\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022tls_ja3\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffda4\u0027_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\ufffd;m\ufffd \ufffd\\n\ufffd\ufffdn8\u059a\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd{\\rO\ufffd\ufffd\ufffd\ufffds3H{\\nm\\r\\n62.3.50.33\\n\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffda4\u0027_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\\u0014\ufffd;m\ufffd\\u001b \ufffd\\n\ufffd\ufffdn8\u059a\ufffd\\u001d\ufffd\ufffd\\u0002\ufffd\ufffd^\ufffd\ufffd\ufffd{\\rO\ufffd\ufffd\ufffd\\u0011\ufffds3H\\u0000{\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022tls_ja3\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffda4\u0027_\u07fc,\ufffd\ufffdEJ\ufffd\ufffd\ufffd2Q\ufffdzs\ufffd\ufffdA\ufffd\ufffdD\ufffd;m\ufffd \ufffd\\n\ufffd\ufffdn8\u059a\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd{\\rO\ufffd\ufffd\ufffd\ufffds3H{\\nm\\r\\n62.3.50.33\\n\ufffd\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.81, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"de8c366fbb06bedcd7b86ddda1addac6","tls_ja3":"771,4865-4866-4867-4868-4869,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022]","anomalies":"[]","severity":5,"bytes_in":1481},{"id":14908113,"ip":"34.19.127.180","ts":"2026-08-01 09:03:52.000000","proto":"tcp","src_port":7360,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 32, \u0022bytes_in\u0022: 1695, \u0022payload_entropy\u0022: 7.612865648814103, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u0022e3b02a9b5814ca599024b420fa82901ef2cdb53d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022payload_hash\u0022: \u0022e1f5fa19b34e575d3f3a4f5f0a29d090\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\\u001b)\\n!\ufffd\\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\\u0001\ufffd\\u0004y\\f\\u001f\ufffd\ufffdRU\ufffd\\u0017\\u001f\u0731\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd,\\u0004\ufffd)\ufffd\u02a5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\\u001b)\\n!\ufffd\\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\\u0001\ufffd\\u0004y\\f\\u001f\ufffd\ufffdRU\ufffd\\u0017\\u001f\u0731\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd,\\u0004\ufffd)\ufffd\u02a5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\\u001b)\\n!\ufffd\\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\\u0001\ufffd\\u0004y\\f\\u001f\ufffd\ufffdRU\ufffd\\u0017\\u001f\u0731\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd,\\u0004\ufffd)\ufffd\u02a5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022221e07a16e4b83615c9713bd2624a7b2d67ef97b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\\u001b)\\n!\ufffd\\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\\u0001\ufffd\\u0004y\\f\\u001f\ufffd\ufffdRU\ufffd\\u0017\\u001f\u0731\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd,\\u0004\ufffd)\ufffd\u02a5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022tls_ja3\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR)\\n!\ufffd\\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\ufffdy\ufffd\ufffdRU\ufffd\u0731\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd)\ufffd\u02a5\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR\\u001b)\\n!\ufffd\\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\\u0001\ufffd\\u0004y\\f\\u001f\ufffd\ufffdRU\ufffd\\u0017\\u001f\u0731\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd,\\u0004\ufffd)\ufffd\u02a5\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022tls_ja3\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffdw1}\ufffdFk\ufffd\ufffdjR)\\n!\ufffd\\rI\ufffd\ufffd\ufffd\ufffd\ufffd`\u0113jWRm \ufffd\ufffdy\ufffd\ufffdRU\ufffd\u0731\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd)\ufffd\u02a5\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.81, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"3947c3d16bc8cd21ac2296ef9eea028d","tls_ja3":"771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":1695},{"id":14908018,"ip":"34.19.127.180","ts":"2026-08-01 09:03:51.000000","proto":"tcp","src_port":54569,"dst_port":8764,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.859122519665847, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8764, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225fcedec66145ae3b327dad80fd3d18700aaf46ca\u0022, \u0022event_fingerprint\u0022: \u002291a95626ec19781aa1f909652fbb4d3dde4a59ab\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022payload_hash\u0022: \u0022792ab810948dbb62220af88a1490fda9\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffdCa\u0655\ufffd\\u001eE\ufffd\\u0014\ufffd\u003C.Y\ufffdCl\ufffd\ufffds\ufffd\u0026\u05ec4\ufffd}\ufffd\ufffd\ufffd\\u001c\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffdCa\u0655\ufffd\\u001eE\ufffd\\u0014\ufffd\u003C.Y\ufffdCl\ufffd\ufffds\ufffd\u0026\u05ec4\ufffd}\ufffd\ufffd\ufffd\\u001c\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffdCa\u0655\ufffd\\u001eE\ufffd\\u0014\ufffd\u003C.Y\ufffdCl\ufffd\ufffds\ufffd\u0026\u05ec4\ufffd}\ufffd\ufffd\ufffd\\u001c\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022669226b80b1672fd9ef54fea56e25fe0d37affde\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffdCa\u0655\ufffd\\u001eE\ufffd\\u0014\ufffd\u003C.Y\ufffdCl\ufffd\ufffds\ufffd\u0026\u05ec4\ufffd}\ufffd\ufffd\ufffd\\u001c\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdCa\u0655\ufffdE\ufffd\ufffd\u003C.Y\ufffdCl\ufffd\ufffds\ufffd\u0026\u05ec4\ufffd}\ufffd\ufffd\ufffd\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8764, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffdCa\u0655\ufffd\\u001eE\ufffd\\u0014\ufffd\u003C.Y\ufffdCl\ufffd\ufffds\ufffd\u0026\u05ec4\ufffd}\ufffd\ufffd\ufffd\\u001c\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdCa\u0655\ufffdE\ufffd\ufffd\u003C.Y\ufffdCl\ufffd\ufffds\ufffd\u0026\u05ec4\ufffd}\ufffd\ufffd\ufffd\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228764\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.8, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"67625c3bd21c099689690498fb5b754e","tls_ja3":"769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908031,"ip":"34.19.127.180","ts":"2026-08-01 09:03:51.000000","proto":"tcp","src_port":50625,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.835694716979506, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u002267576e2e5639b025b861945e60b6b4ebeb68da22\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022payload_hash\u0022: \u00227dc1cf30846d39d9e3e247435feeb925\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022}, \u0022tls_ja3\u0022: \u0022770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022browser_like\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u00020V~\u003E\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\\u0003\ufffd\ufffd\ufffdJ\ufffd\\u0016m\ufffd\ufffdH\ufffd\ufffd\\u001e\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u00020V~\u003E\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\\u0003\ufffd\ufffd\ufffdJ\ufffd\\u0016m\ufffd\ufffdH\ufffd\ufffd\\u001e\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u00020V~\u003E\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\\u0003\ufffd\ufffd\ufffdJ\ufffd\\u0016m\ufffd\ufffdH\ufffd\ufffd\\u001e\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002280ead6bd1247640013b85b969b977e132365d492\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u00020V~\u003E\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\\u0003\ufffd\ufffd\ufffdJ\ufffd\\u0016m\ufffd\ufffdH\ufffd\ufffd\\u001e\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd0V~\u003E\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdJ\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u00020V~\u003E\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\\u0003\ufffd\ufffd\ufffdJ\ufffd\\u0016m\ufffd\ufffdH\ufffd\ufffd\\u001e\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd0V~\u003E\ufffd\ufffd\ufffdH\ufffdR#\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdJ\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.81, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"f9b8f0bb9fb9f179320b2833fbe71c48","tls_ja3":"770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908051,"ip":"34.19.127.180","ts":"2026-08-01 09:03:51.000000","proto":"tcp","src_port":49842,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 102, \u0022bytes_in\u0022: 899, \u0022payload_entropy\u0022: 5.73852240793123, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u00229c33a4e0d4fc455056cfdc91bf0b498dec73c162\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022payload_hash\u0022: \u00222acb1107aa098f05f19e3cb823f35c36\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u001a\\u0000\\u001b\\u0000\\u001e\\u0000\\u001f\\u0000 \\u0000!\\u0000\\\u0022\\u0000#\\u0000$\\u0000%\\u0000\u0026\\u0000\u0027\\u0000(\\u0000)\\u0000*\\u0000+\\u0000,\\u0000-\\u0000.\\u0000\/\\u00000\\u00001\\u00002\\u00003\\u00004\\u00005\\u00006\\u00007\\u00008\\u00009\\u0000:\\u0000;\\u0000\u003C\\u0000=\\u0000\u003E\\u0000?\\u0000@\\u0000A\\u0000B\\u0000C\\u0000D\\u0000E\\u0000F\\u0000g\\u0000h\\u0000i\\u0000j\\u0000k\\u0000l\\u0000m\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220b4087337350a0b6020096e1e7e00896eef3099f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH\u003C\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH\u003C\ufffd\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.82, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"4ae33de1ad93956213297c61748ec996","tls_ja3":"771,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-103-104-105-106-107-108-109-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-4870-4871-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-49332-49333-49408-49409-49410-49411-49412-49413-49414-52392-52393-52394-52395-52396-52397-52398-53249-53250-53251-53253-255,0-11-35-13-10,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":899},{"id":14908069,"ip":"34.19.127.180","ts":"2026-08-01 09:03:51.000000","proto":"tcp","src_port":1347,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 32, \u0022bytes_in\u0022: 351, \u0022payload_entropy\u0022: 5.359284275134907, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u0022144b1e52aa86a58ec6c4d4cd06d7794a2ddc7c5a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022payload_hash\u0022: \u0022255eec531ee278b85836fca3a8ea94d2\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd{_\ufffd\ufffd\\\\$l\ufffd\ufffd\ufffd\\u00050\ufffd\ufffdo\ufffd\\\u0022\ufffd\ufffdXc\u0026\\u0016}o!*\ufffd\\u001d`\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd{_\ufffd\ufffd\\\\$l\ufffd\ufffd\ufffd\\u00050\ufffd\ufffdo\ufffd\\\u0022\ufffd\ufffdXc\u0026\\u0016}o!*\ufffd\\u001d`\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000;\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000k\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd{_\ufffd\ufffd\\\\$l\ufffd\ufffd\ufffd\\u00050\ufffd\ufffdo\ufffd\\\u0022\ufffd\ufffdXc\u0026\\u0016}o!*\ufffd\\u001d`\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223a4378c9cbec67d6d3700b8ca131b7fe2e815871\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd{_\ufffd\ufffd\\\\$l\ufffd\ufffd\ufffd\\u00050\ufffd\ufffdo\ufffd\\\u0022\ufffd\ufffdXc\u0026\\u0016}o!*\ufffd\\u001d`\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022ZV\ufffd\ufffd{_\ufffd\ufffd\\\\$l\ufffd\ufffd\ufffd0\ufffd\ufffdo\ufffd\\\u0022\ufffd\ufffdXc\u0026}o!*\ufffd`\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd{_\ufffd\ufffd\\\\$l\ufffd\ufffd\ufffd\\u00050\ufffd\ufffdo\ufffd\\\u0022\ufffd\ufffdXc\u0026\\u0016}o!*\ufffd\\u001d`\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022ZV\ufffd\ufffd{_\ufffd\ufffd\\\\$l\ufffd\ufffd\ufffd0\ufffd\ufffdo\ufffd\\\u0022\ufffd\ufffdXc\u0026}o!*\ufffd`\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.8, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"1efa91265313b0607d774cf0cdfebe64","tls_ja3":"771,49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-22-23-13,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":351},{"id":14907936,"ip":"34.19.127.180","ts":"2026-08-01 09:03:50.000000","proto":"tcp","src_port":46579,"dst_port":8764,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 32, \u0022bytes_in\u0022: 1695, \u0022payload_entropy\u0022: 7.601669455507244, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8764, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225fcedec66145ae3b327dad80fd3d18700aaf46ca\u0022, \u0022event_fingerprint\u0022: \u0022b33cbf940974eac6cadced1a696156d8de8b11dd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022payload_hash\u0022: \u00225ceeef7ce938ddafd4c60390d1e6e659\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd8\u06d37\ufffd\\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\\\ufffd-\\u0007~\\b \ufffdV\ufffd\\\\\ufffdL\ufffd\\\\\ufffd\ufffd\u003E]\\u0011\\\u0022uXu\\u0019\ufffd\\u0012f\ufffd\ufffd%\ufffd\ufffdq\\u0013\ufffd!F\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd8\u06d37\ufffd\\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\\\ufffd-\\u0007~\\b \ufffdV\ufffd\\\\\ufffdL\ufffd\\\\\ufffd\ufffd\u003E]\\u0011\\\u0022uXu\\u0019\ufffd\\u0012f\ufffd\ufffd%\ufffd\ufffdq\\u0013\ufffd!F\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd8\u06d37\ufffd\\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\\\ufffd-\\u0007~\\b \ufffdV\ufffd\\\\\ufffdL\ufffd\\\\\ufffd\ufffd\u003E]\\u0011\\\u0022uXu\\u0019\ufffd\\u0012f\ufffd\ufffd%\ufffd\ufffdq\\u0013\ufffd!F\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022667c4b3fab34e44792f5450182e720b10b9927a2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd8\u06d37\ufffd\\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\\\ufffd-\\u0007~\\b \ufffdV\ufffd\\\\\ufffdL\ufffd\\\\\ufffd\ufffd\u003E]\\u0011\\\u0022uXu\\u0019\ufffd\\u0012f\ufffd\ufffd%\ufffd\ufffdq\\u0013\ufffd!F\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022tls_ja3\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd8\u06d37\ufffd_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\\\ufffd-~ \ufffdV\ufffd\\\\\ufffdL\ufffd\\\\\ufffd\ufffd\u003E]\\\u0022uXu\ufffdf\ufffd\ufffd%\ufffd\ufffdq\ufffd!F\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8764, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\ufffd8\u06d37\ufffd\\u0000_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\\\ufffd-\\u0007~\\b \ufffdV\ufffd\\\\\ufffdL\ufffd\\\\\ufffd\ufffd\u003E]\\u0011\\\u0022uXu\\u0019\ufffd\\u0012f\ufffd\ufffd%\ufffd\ufffdq\\u0013\ufffd!F\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022tls_ja3\u0022: \u00223947c3d16bc8cd21ac2296ef9eea028d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd8\u06d37\ufffd_\ufffdE\ufffdU_RrG\ufffd$=\ufffd\ufffd;m\ufffdq\\\\\ufffd-~ \ufffdV\ufffd\\\\\ufffdL\ufffd\\\\\ufffd\ufffd\u003E]\\\u0022uXu\ufffdf\ufffd\ufffd%\ufffd\ufffdq\ufffd!F\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228764\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.92, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"3947c3d16bc8cd21ac2296ef9eea028d","tls_ja3":"771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":1695},{"id":14907944,"ip":"34.19.127.180","ts":"2026-08-01 09:03:50.000000","proto":"tcp","src_port":18888,"dst_port":9023,"service":"devops-probe","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 351, \u0022payload_entropy\u0022: 5.395437995749987, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022devops-probe\u0022, \u0022app_proto\u0022: \u0022devops-probe\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9023, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fadef17fbfbe857adbca975016d2c0235abc5bf0\u0022, \u0022event_fingerprint\u0022: \u0022ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002209550c21828c7db54d9eff7cb87fbc1a\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\\u0004b{\\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\\u0004b{\\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000;\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000k\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\\u0004b{\\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022deaa9bab40c2f27e31ca0e4164185e225de7a2d0\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\\u0004b{\\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022evidence_snippet\u0022: \u0022ZV\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffdb{\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022dst_port\u0022: 9023, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffd\\u0004b{\\u000e\ufffd\ufffd\ufffd_\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022ZV\ufffdEkR\ufffdO\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd7\ufffdc\u0384\ufffdb{\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022devops_probe\u0022, \u0022service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229023\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.9, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":351},{"id":14907946,"ip":"34.19.127.180","ts":"2026-08-01 09:03:50.000000","proto":"tcp","src_port":34079,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022e53406bbb3118b0c8a662f6717ac159d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 102, \u0022bytes_in\u0022: 899, \u0022payload_entropy\u0022: 5.743432840089055, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u0022fd753490a1d14fe156f7d8f8abe86003f4182787\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022e53406bbb3118b0c8a662f6717ac159d\u0022, \u0022payload_hash\u0022: \u0022375bc25b4e3fa3e807d5e897a8e763fb\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffdw\ufffd\ufffdH\\r\ufffd\\u0000\u06e2\\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd\u0026$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\\u0010\ufffdr\ufffd\ufffdg\ufffdH;\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffdw\ufffd\ufffdH\\r\ufffd\\u0000\u06e2\\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd\u0026$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\\u0010\ufffdr\ufffd\ufffdg\ufffdH;\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u001a\\u0000\\u001b\\u0000\\u001e\\u0000\\u001f\\u0000 \\u0000!\\u0000\\\u0022\\u0000#\\u0000$\\u0000%\\u0000\u0026\\u0000\u0027\\u0000(\\u0000)\\u0000*\\u0000+\\u0000,\\u0000-\\u0000.\\u0000\/\\u00000\\u00001\\u00002\\u00003\\u00004\\u00005\\u00006\\u00007\\u00008\\u00009\\u0000:\\u0000;\\u0000\u003C\\u0000=\\u0000\u003E\\u0000?\\u0000@\\u0000A\\u0000B\\u0000C\\u0000D\\u0000E\\u0000F\\u0000g\\u0000h\\u0000i\\u0000j\\u0000k\\u0000l\\u0000m\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffdw\ufffd\ufffdH\\r\ufffd\\u0000\u06e2\\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd\u0026$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\\u0010\ufffdr\ufffd\ufffdg\ufffdH;\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c7cfe290a730dcb9f53c9da5dec8c8183dadefef\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffdw\ufffd\ufffdH\\r\ufffd\\u0000\u06e2\\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd\u0026$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\\u0010\ufffdr\ufffd\ufffdg\ufffdH;\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u0022e53406bbb3118b0c8a662f6717ac159d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdw\ufffd\ufffdH\\r\ufffd\u06e2Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd\u0026$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\ufffdr\ufffd\ufffdg\ufffdH;\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0001jm\ufffdw\ufffd\ufffdH\\r\ufffd\\u0000\u06e2\\u0011Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd\u0026$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\\u0003\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\\u0010\ufffdr\ufffd\ufffdg\ufffdH;\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u0022e53406bbb3118b0c8a662f6717ac159d\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdw\ufffd\ufffdH\\r\ufffd\u06e2Jm8\ufffd\ufffd\ufffd\ufffd \u0751c\ufffd\u0026$\ufffd#p\ufffd\ufffd \ufffd\ufffdH$:\u06f9\ufffdLmOU\ufffd\ufffd\ufffd\ufffd\u07d1zd)$\ufffdr\ufffd\ufffdg\ufffdH;\ufffd\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.89, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"e53406bbb3118b0c8a662f6717ac159d","tls_ja3":"769,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-103-104-105-106-107-108-109-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-4870-4871-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-49332-49333-49408-49409-49410-49411-49412-49413-49414-52392-52393-52394-52395-52396-52397-52398-53249-53250-53251-53253-255,0-11-35-13-10,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":899},{"id":14907968,"ip":"34.19.127.180","ts":"2026-08-01 09:03:50.000000","proto":"tcp","src_port":14086,"dst_port":8764,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 32, \u0022bytes_in\u0022: 351, \u0022payload_entropy\u0022: 5.344307350929435, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8764, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225fcedec66145ae3b327dad80fd3d18700aaf46ca\u0022, \u0022event_fingerprint\u0022: \u00226ec0006ee2b31618365dde5e5ec166698152a891\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022payload_hash\u0022: \u00223a51d434d8ef8f3cf792f32d00dd5bc7\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003AeW\ufffd\\f\ufffd\\u001a\u1553\ufffd\ufffd\u5b92\ufffd\\u0002\u07fe\ufffd\ufffd\\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\\\;\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003AeW\ufffd\\f\ufffd\\u001a\u1553\ufffd\ufffd\u5b92\ufffd\\u0002\u07fe\ufffd\ufffd\\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\\\;\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000;\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000k\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003AeW\ufffd\\f\ufffd\\u001a\u1553\ufffd\ufffd\u5b92\ufffd\\u0002\u07fe\ufffd\ufffd\\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\\\;\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225db46977a01a56abe760d65c32b7d8fd9b606eae\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003AeW\ufffd\\f\ufffd\\u001a\u1553\ufffd\ufffd\u5b92\ufffd\\u0002\u07fe\ufffd\ufffd\\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\\\;\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022ZVAeW\ufffd\ufffd\u1553\ufffd\ufffd\u5b92\ufffd\u07fe\ufffd\ufffd\\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\\\;\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8764, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003AeW\ufffd\\f\ufffd\\u001a\u1553\ufffd\ufffd\u5b92\ufffd\\u0002\u07fe\ufffd\ufffd\\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\\\;\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022ZVAeW\ufffd\ufffd\u1553\ufffd\ufffd\u5b92\ufffd\u07fe\ufffd\ufffd\\t\ufffd\ufffd\ufffd\u07f4}\ufffd\\\\;\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228764\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.85, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"1efa91265313b0607d774cf0cdfebe64","tls_ja3":"771,49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-22-23-13,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":351},{"id":14907977,"ip":"34.19.127.180","ts":"2026-08-01 09:03:50.000000","proto":"tcp","src_port":32152,"dst_port":9023,"service":"devops-probe","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.881409002693791, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022devops-probe\u0022, \u0022app_proto\u0022: \u0022devops-probe\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9023, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fadef17fbfbe857adbca975016d2c0235abc5bf0\u0022, \u0022event_fingerprint\u0022: \u0022ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022852c1ba041d875bcffb5df08db59119d\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022}, \u0022tls_ja3_hash\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja3\u0022: \u0022770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002n\ufffd\\u0005*\\\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\\u0003\u036f\u0026\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002n\ufffd\\u0005*\\\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\\u0003\u036f\u0026\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002n\ufffd\\u0005*\\\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\\u0003\u036f\u0026\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a7c797c491054232a37c9d584fa6e90abf4e3e2c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002n\ufffd\\u0005*\\\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\\u0003\u036f\u0026\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdn\ufffd*\\\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\ufffd\ufffd{H\ufffdh8:\ufffdr\u036f\u0026\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022dst_port\u0022: 9023, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002n\ufffd\\u0005*\\\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\\u001d\ufffd\ufffd{H\ufffdh8:\ufffdr\\u0003\u036f\u0026\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdn\ufffd*\\\\\ufffd\ufffdp\ufffd\ufffdC\u02ff.+\ufffd\ufffd\ufffd{H\ufffdh8:\ufffdr\u036f\u0026\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022devops_probe\u0022, \u0022service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229023\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.84, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14907980,"ip":"34.19.127.180","ts":"2026-08-01 09:03:50.000000","proto":"tcp","src_port":57040,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.843278918657326, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u0022d1e634537db6a515f9c0042999a3a84eb4b27fad\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022payload_hash\u0022: \u002298ecd66ab7421ed84de333d84c538043\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\\u0000d\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\\u0000d\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\\u0000d\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022809578196aba48b9c2f4a1418f93ca3f5e71a198\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\\u0000d\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdTdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\\u0004\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdT\\u0000d\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd \ufffdHnC\ufffd\ufffdX#?\ufffd\ufffd\u8104wj8\ufffd\ufffd\ufffd\ufffdKB\ufffd\ufffdTdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.84, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"67625c3bd21c099689690498fb5b754e","tls_ja3":"769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14907993,"ip":"34.19.127.180","ts":"2026-08-01 09:03:50.000000","proto":"tcp","src_port":15367,"dst_port":8764,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.852155199957998, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8764, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225fcedec66145ae3b327dad80fd3d18700aaf46ca\u0022, \u0022event_fingerprint\u0022: \u0022db826933ae27a2eb10e83c34641a7b84f3456ff4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022payload_hash\u0022: \u002241b2e9fd70bf72242c9751c91dd01498\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022}, \u0022tls_ja3\u0022: \u0022770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022browser_like\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\\u0003{\ufffd\ufffdhN\u0027\\u0013#{\ufffdG\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\\u0003{\ufffd\ufffdhN\u0027\\u0013#{\ufffdG\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\\u0003{\ufffd\ufffdhN\u0027\\u0013#{\ufffdG\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022631edf702811a2ef9760dc9cfe71c18a2191f301\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\\u0003{\ufffd\ufffdhN\u0027\\u0013#{\ufffdG\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY{\ufffd\ufffdhN\u0027#{\ufffdGF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8764, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY\\u0003{\ufffd\ufffdhN\u0027\\u0013#{\ufffdG\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdD7\ufffdd3\ufffd\ufffd\uf0c5g\ufffd\ufffd\ufffdP(I\ufffdY{\ufffd\ufffdhN\u0027#{\ufffdGF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228764\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.8, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"f9b8f0bb9fb9f179320b2833fbe71c48","tls_ja3":"770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908001,"ip":"34.19.127.180","ts":"2026-08-01 09:03:50.000000","proto":"tcp","src_port":18779,"dst_port":9023,"service":"devops-probe","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.884780948212551, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022devops-probe\u0022, \u0022app_proto\u0022: \u0022devops-probe\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9023, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fadef17fbfbe857adbca975016d2c0235abc5bf0\u0022, \u0022event_fingerprint\u0022: \u0022ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002278a3f7d7c7b2ccb2051c79e4dd5c8f0a\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja3\u0022: \u0022769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0301\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\u0013\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\\u0012\ufffd4\ufffdp\ufffd7\u0027\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\u0013\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\\u0012\ufffd4\ufffdp\ufffd7\u0027\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\u0013\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\\u0012\ufffd4\ufffdp\ufffd7\u0027\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002265cd18f07a4adfe481c36f0a94be57666d6aea3f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\u0013\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\\u0012\ufffd4\ufffdp\ufffd7\u0027\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd4\ufffdp\ufffd7\u0027\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022dst_port\u0022: 9023, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0001\\u0013\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\ufffdE\\u0012\ufffd4\ufffdp\ufffd7\u0027\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002267625c3bd21c099689690498fb5b754e\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd4\ufffdp\ufffd7\u0027\ufffd\ufffd\ufffd\ufffd\ufffduo Z\ufffd\ufffdH\ufffdU\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022devops_probe\u0022, \u0022service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229023\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.81, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14908005,"ip":"34.19.127.180","ts":"2026-08-01 09:03:50.000000","proto":"tcp","src_port":33152,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221196e3b1fa255a444a88617c122e45a5\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 102, \u0022bytes_in\u0022: 899, \u0022payload_entropy\u0022: 5.739239353154586, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022276e969e3ee858facd54d296ed8db7f7302ac426\u0022, \u0022event_fingerprint\u0022: \u002256a07a54588daae8b9ef983f8d0b11a33d8d1060\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221196e3b1fa255a444a88617c122e45a5\u0022, \u0022payload_hash\u0022: \u002258fbda8fc08e90de27fd8010e50787d8\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u001a\\u0000\\u001b\\u0000\\u001e\\u0000\\u001f\\u0000 \\u0000!\\u0000\\\u0022\\u0000#\\u0000$\\u0000%\\u0000\u0026\\u0000\u0027\\u0000(\\u0000)\\u0000*\\u0000+\\u0000,\\u0000-\\u0000.\\u0000\/\\u00000\\u00001\\u00002\\u00003\\u00004\\u00005\\u00006\\u00007\\u00008\\u00009\\u0000:\\u0000;\\u0000\u003C\\u0000=\\u0000\u003E\\u0000?\\u0000@\\u0000A\\u0000B\\u0000C\\u0000D\\u0000E\\u0000F\\u0000g\\u0000h\\u0000i\\u0000j\\u0000k\\u0000l\\u0000m\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002266c22316db4eff5bcd942c854b4b630d5f7ea215\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00221196e3b1fa255a444a88617c122e45a5\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH\u003C\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0002jm\ufffdx\ufffd\ufffdH\\u000eo\\u0000\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffd\\u001ap\ufffd\ufffd \ufffd\ufffdH%!\\u0003\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\\u0011\ufffdr\ufffd\ufffdN\ufffdH\u003C\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00221196e3b1fa255a444a88617c122e45a5\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdx\ufffd\ufffdHo\u06e3\ufffdIm9p\ufffd\ufffd\ufffd\ufffd\u0711d\ufffd\u0026$\ufffdp\ufffd\ufffd \ufffd\ufffdH%!\u06fa\ufffdLmP$\ufffd\ufffd\ufffd\u07d1{3)$\ufffdr\ufffd\ufffdN\ufffdH\u003C\ufffd\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.81, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"1196e3b1fa255a444a88617c122e45a5","tls_ja3":"770,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-103-104-105-106-107-108-109-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-4870-4871-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-49332-49333-49408-49409-49410-49411-49412-49413-49414-52392-52393-52394-52395-52396-52397-52398-53249-53250-53251-53253-255,0-11-35-13-10,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":899},{"id":14907912,"ip":"34.19.127.180","ts":"2026-08-01 09:03:49.000000","proto":"tcp","src_port":40264,"dst_port":9023,"service":"devops-probe","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 1695, \u0022payload_entropy\u0022: 7.604625875698278, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022devops-probe\u0022, \u0022app_proto\u0022: \u0022devops-probe\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9023, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fadef17fbfbe857adbca975016d2c0235abc5bf0\u0022, \u0022event_fingerprint\u0022: \u0022ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022003bbf442342091b989868562c67d52c\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\\f\ufffd\ufffd\ufffd\\u0005?8\u02dd8\ufffd\ufffd\ufffd_\\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\\u0016\ufffd 0\\u000e\ufffdh,\ufffd\\n\ufffd\\f\ufffd\u003C\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\\u0019d\\f\ufffdV\ufffdV\ufffd\\fA\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\\f\ufffd\ufffd\ufffd\\u0005?8\u02dd8\ufffd\ufffd\ufffd_\\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\\u0016\ufffd 0\\u000e\ufffdh,\ufffd\\n\ufffd\\f\ufffd\u003C\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\\u0019d\\f\ufffdV\ufffdV\ufffd\\fA\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\\f\ufffd\ufffd\ufffd\\u0005?8\u02dd8\ufffd\ufffd\ufffd_\\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\\u0016\ufffd 0\\u000e\ufffdh,\ufffd\\n\ufffd\\f\ufffd\u003C\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\\u0019d\\f\ufffdV\ufffdV\ufffd\\fA\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cf8177a3d3e00465325590a5d5b2fa9c42dc3bf0\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\\f\ufffd\ufffd\ufffd\\u0005?8\u02dd8\ufffd\ufffd\ufffd_\\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\\u0016\ufffd 0\\u000e\ufffdh,\ufffd\\n\ufffd\\f\ufffd\u003C\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\\u0019d\\f\ufffdV\ufffdV\ufffd\\fA\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd?8\u02dd8\ufffd\ufffd\ufffd_7C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\ufffd 0\ufffdh,\ufffd\\n\ufffd\ufffd\u003C\ufffd\ufffd,.\ufffdm\ufffdS\ufffdd\ufffdV\ufffdV\ufffdA\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022dst_port\u0022: 9023, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0006\ufffd\\u0001\\u0000\\u0006\ufffd\\u0003\\u0003\\f\ufffd\ufffd\ufffd\\u0005?8\u02dd8\ufffd\ufffd\ufffd_\\u00147C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\\u0016\ufffd 0\\u000e\ufffdh,\ufffd\\n\ufffd\\f\ufffd\u003C\ufffd\ufffd,.\ufffdm\ufffdS\ufffd\\u0019d\\f\ufffdV\ufffdV\ufffd\\fA\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd?8\u02dd8\ufffd\ufffd\ufffd_7C3B\ufffd 4\ufffd\ufffdS\ufffd\ufffd`\ufffd\ufffd\ufffd 0\ufffdh,\ufffd\\n\ufffd\ufffd\u003C\ufffd\ufffd,.\ufffdm\ufffdS\ufffdd\ufffdV\ufffdV\ufffdA\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022devops_probe\u0022, \u0022service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229023\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.82, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":1695},{"id":14907915,"ip":"34.19.127.180","ts":"2026-08-01 09:03:49.000000","proto":"tcp","src_port":57619,"dst_port":9043,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: null, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 11, \u0022payload_entropy\u0022: 2.2221915755066783, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 23.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 23.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002258083672fa93c640310389ca8fbad9ab1e6c61a9\u0022, \u0022event_fingerprint\u0022: \u0022057b6ddf4aa87067adeb21d1234e9cefcd1e4f2f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 23.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002255b6c6b63391f7a244877208a3a6144c\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226d9a852ccaff39d1166d666a1e45e663fe1cfa4a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 23.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0000\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0000\u0022, \u0022port\u0022: 9043, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00229043 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.82, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":5,"bytes_in":11},{"id":14907832,"ip":"34.19.127.180","ts":"2026-08-01 09:03:49.000000","proto":"tcp","src_port":40087,"dst_port":8764,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 32, \u0022bytes_in\u0022: 351, \u0022payload_entropy\u0022: 5.3395700741703935, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8764, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225fcedec66145ae3b327dad80fd3d18700aaf46ca\u0022, \u0022event_fingerprint\u0022: \u00226ec0006ee2b31618365dde5e5ec166698152a891\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022payload_hash\u0022: \u00227c719d704df4ce6c0381bb3e0c775fd1\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\\\\\ufffd\ufffda2\u0027$;\ufffd\ufffd\\u000b\ufffd\ufffd\\u0010nb\ufffd\\u001d\\u0018Eg\\u001c\\u001cYLX\ufffd?a\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\\\\\ufffd\ufffda2\u0027$;\ufffd\ufffd\\u000b\ufffd\ufffd\\u0010nb\ufffd\\u001d\\u0018Eg\\u001c\\u001cYLX\ufffd?a\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000;\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000k\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\\\\\ufffd\ufffda2\u0027$;\ufffd\ufffd\\u000b\ufffd\ufffd\\u0010nb\ufffd\\u001d\\u0018Eg\\u001c\\u001cYLX\ufffd?a\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222ac2d5d7f09e248deb5ed4d95ff9bd21bde765ad\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\\\\\ufffd\ufffda2\u0027$;\ufffd\ufffd\\u000b\ufffd\ufffd\\u0010nb\ufffd\\u001d\\u0018Eg\\u001c\\u001cYLX\ufffd?a\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022ZV\ufffd\\\\\ufffd\ufffda2\u0027$;\ufffd\ufffd\ufffd\ufffdnb\ufffdEgYLX\ufffd?a\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8764, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\\\\\ufffd\ufffda2\u0027$;\ufffd\ufffd\\u000b\ufffd\ufffd\\u0010nb\ufffd\\u001d\\u0018Eg\\u001c\\u001cYLX\ufffd?a\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022tls_ja3\u0022: \u00221efa91265313b0607d774cf0cdfebe64\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022ZV\ufffd\\\\\ufffd\ufffda2\u0027$;\ufffd\ufffd\ufffd\ufffdnb\ufffdEgYLX\ufffd?a\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228764\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 12, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.62, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"1efa91265313b0607d774cf0cdfebe64","tls_ja3":"771,49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-22-23-13,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":351},{"id":14907847,"ip":"34.19.127.180","ts":"2026-08-01 09:03:49.000000","proto":"tcp","src_port":45065,"dst_port":9023,"service":"devops-probe","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 1474, \u0022payload_entropy\u0022: 7.737164685636475, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022devops-probe\u0022, \u0022app_proto\u0022: \u0022devops-probe\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9023, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fadef17fbfbe857adbca975016d2c0235abc5bf0\u0022, \u0022event_fingerprint\u0022: \u0022ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c880e28748501c9c1eb02d767b1eb59a\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000.\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0005\\u0001\\u0005\\u0002\\u0005\\u0003\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0003\\u0001\\u0003\\u0002\\u0003\\u0003\\u0002\\u0001\\u0002\\u0002\\u0002\\u0003\\u0000\\n\\u0000\\u0018\\u0000\\u0016\\u0000\\u0017\\u0000\\u0019\\u0000\\u0018\\u0000\\u001d\\u0000\\u001e\\u0001\\u0000\\u0001\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0011\ufffdc\ufffd\\u00003\\u0004\ufffd\\u0004\ufffd\\u0000\\u001d\\u0000 \ufffd\ufffdNB\ufffd0)\ufffds\ufffdU\ufffdcO\ufffd\ufffd\\u0013\ufffdT\ufffdn\u003E\ufffd\ufffd\ufffdL\ufffd3?t5\\u0011\ufffd\\u0004\ufffd\ufffd$\ufffd\u00d7\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022820e25c97ebdc2c3ecb1af785fe94b6b9e068410\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\\nf\\r\\n62.3.50.33#\\r0\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022dst_port\u0022: 9023, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\\nf\\r\\n62.3.50.33#\\r0\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022devops_probe\u0022, \u0022service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229023\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 12, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.6, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":1474},{"id":14907863,"ip":"34.19.127.180","ts":"2026-08-01 09:03:49.000000","proto":"tcp","src_port":37095,"dst_port":9043,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221967e2ac78c4d195e7bb531768614cff63779fa2\u0022, \u0022event_fingerprint\u0022: \u0022a5d960ec4504b5b264e69a508b26c9d11ef8f308\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fce046332eaff7a2d488ed32d7c21b21877593b7\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 9043}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 9043}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00229043\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.9, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":14907867,"ip":"34.19.127.180","ts":"2026-08-01 09:03:49.000000","proto":"tcp","src_port":10392,"dst_port":8764,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022959770bcbec3f21ef183c822429f3d47\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022bytes_in\u0022: 1474, \u0022payload_entropy\u0022: 7.71369176153976, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8764, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221c194275f715ceeb291b1cb8ebcfceaaba595331\u0022, \u0022event_fingerprint\u0022: \u0022c097051014870d7fe0bfb54777832d20679cada3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022959770bcbec3f21ef183c822429f3d47\u0022, \u0022payload_hash\u0022: \u002252e6f32a0610afb9ce3a3e0360089fa8\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000.\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0005\\u0001\\u0005\\u0002\\u0005\\u0003\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0003\\u0001\\u0003\\u0002\\u0003\\u0003\\u0002\\u0001\\u0002\\u0002\\u0002\\u0003\\u0000\\n\\u0000\\u0018\\u0000\\u0016\\u0000\\u0017\\u0000\\u0019\\u0000\\u0018\\u0000\\u001d\\u0000\\u001e\\u0001\\u0000\\u0001\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0011\ufffdc\ufffd\\u00003\\u0004\ufffd\\u0004\ufffd\\u0000\\u001d\\u0000 \ufffd\ufffd\u0613\ufffd\ufffd6|\u011f\ufffdv\ufffd\ufffd5\ufffd\\u0002YL\u0407\ufffdx4\ufffd\ufffdJM}\\\u0022R\\u0011\ufffd\\u0004\ufffd\ufffd\ufffd]?1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229a7ba45f800793f38cc9c6a4f80ed40dca28be5d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022959770bcbec3f21ef183c822429f3d47\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\\nf\\r\\n62.3.50.33#\\r0\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8764, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003jm\ufffdv\ufffd\ufffdH\\f\ufffd\\u0000\u06e1\\u0012Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\\u0003\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\\u000f\ufffdr\ufffd\ufffdh\ufffdH:\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005f\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000#\\u0000\\u0000\\u0000\\r\\u00000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022959770bcbec3f21ef183c822429f3d47\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdjm\ufffdv\ufffd\ufffdH\ufffd\u06e1Jm7\ufffd\ufffd\ufffd\ufffd!\u0751b\ufffd\u0026$\ufffd$p\ufffd\ufffd \ufffd\ufffdH#;\u06f8\ufffdLmNV\ufffd\ufffd\ufffd\ufffd\u07d1ye)$\ufffdr\ufffd\ufffdh\ufffdH:\\nf\\r\\n62.3.50.33#\\r0\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228764\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.89, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"959770bcbec3f21ef183c822429f3d47","tls_ja3":"771,4865-4866-4867-4868-4869,0-11-35-13-10-25497-4705,23-25-24-29-30-256-257-258-259-260-4588,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022]","anomalies":"[]","severity":5,"bytes_in":1474},{"id":14907879,"ip":"34.19.127.180","ts":"2026-08-01 09:03:49.000000","proto":"tcp","src_port":50592,"dst_port":9023,"service":"devops-probe","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 1481, \u0022payload_entropy\u0022: 7.7355077848305775, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022devops-probe\u0022, \u0022app_proto\u0022: \u0022devops-probe\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9023, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fadef17fbfbe857adbca975016d2c0235abc5bf0\u0022, \u0022event_fingerprint\u0022: \u0022ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227c6fa5c8e9266286bf8fbb872cbbef86\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdnx\ufffd(\ufffd\ufffd\u0026\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\\u0019 U\ufffd?\\u001f\\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\u003EV5%V\\u0013\\u0014\\t\\u0017\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdnx\ufffd(\ufffd\ufffd\u0026\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\\u0019 U\ufffd?\\u001f\\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\u003EV5%V\\u0013\\u0014\\t\\u0017\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0001\\u0000\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000*\\u0000(\\t\\u0005\\t\\u0006\\t\\u0004\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\u001a\\b\\u001b\\b\\u001c\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\\u0013lp.2c\ufffd[E\\u0013\ufffd\ufffdkW\ufffd6d\ufffd5\ufffdl\\r\ufffd\ufffdv6W\ufffdHw{;?\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdnx\ufffd(\ufffd\ufffd\u0026\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\\u0019 U\ufffd?\\u001f\\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\u003EV5%V\\u0013\\u0014\\t\\u0017\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002298156049f78bee1b63280dbd023989b108583d44\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdnx\ufffd(\ufffd\ufffd\u0026\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\\u0019 U\ufffd?\\u001f\\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\u003EV5%V\\u0013\\u0014\\t\\u0017\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdnx\ufffd(\ufffd\ufffd\u0026\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd U\ufffd?\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\ufffd\ufffd\ufffd\u003EV5%V\\t\\nm\\r\\n62.3.50.33\\n\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022dst_port\u0022: 9023, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdnx\ufffd(\ufffd\ufffd\u0026\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd\\u0019 U\ufffd?\\u001f\\u001a\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\u003EV5%V\\u0013\\u0014\\t\\u0017\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdnx\ufffd(\ufffd\ufffd\u0026\ufffdr\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffda\ufffd U\ufffd?\ufffd\u03d1\ufffdY\ufffd\ufffdA\ufffdeC]\ufffd\ufffd\ufffd\ufffd\ufffd\u003EV5%V\\t\\nm\\r\\n62.3.50.33\\n\ufffd\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022devops_probe\u0022, \u0022service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229023\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.87, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":1481},{"id":14907882,"ip":"34.19.127.180","ts":"2026-08-01 09:03:49.000000","proto":"tcp","src_port":48464,"dst_port":9043,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 54, \u0022payload_entropy\u0022: 3.705848099200768, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9043, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 8.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221967e2ac78c4d195e7bb531768614cff63779fa2\u0022, \u0022event_fingerprint\u0022: \u0022a5d960ec4504b5b264e69a508b26c9d11ef8f308\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d7b673fcc625b3fe0c577928300be63e\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9043, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022request_sample\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022payload_snippet\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022payload_snippet\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b516fb4d327527ab82ca7d4594bc18731a3cd8f4\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022port\u0022: 9043}, \u0022evidence_snippet\u0022: \u0022\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 9043 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229043\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 8.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 9043, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd4\\u0001\\u0000\\u0002\\u0000\\u001b\\u0000\\u0000\\u0000\\u0010\\u0005\\u0000\ufffd\\u0003\\u0000\ufffd\\u0001\\u0000\ufffd\\u0007\\u0000\ufffd\\b\\u0000\ufffd\\u0006\\u0000@\\u0004\\u0000\ufffd\\u0002\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0001\\u0002\\u0003\\u0004\\u0005\\u0006\\u0007\\b\\t\\n\\u000b\\f\\r\\u000e\\u000f\u0022, \u0022port\u0022: 9043}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 9043 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00229043\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229043\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.86, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":5,"bytes_in":54},{"id":14907902,"ip":"34.19.127.180","ts":"2026-08-01 09:03:49.000000","proto":"tcp","src_port":14185,"dst_port":8764,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022bytes_in\u0022: 1481, \u0022payload_entropy\u0022: 7.730113668502134, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8764, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221c194275f715ceeb291b1cb8ebcfceaaba595331\u0022, \u0022event_fingerprint\u0022: \u00225921b6d7173732f1fba4c8e4cca0d7c104024d57\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022payload_hash\u0022: \u00222fcd15eedee1419ba850c995dd0ac583\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffd*C\ufffd0\ufffd \ufffd\\ry\ufffdq\ufffd\ufffd6\\th)\\f\ufffd\\u0002*\\u0000\ufffd?\ufffd\ufffd\\u0018|\ufffd\ufffd\ufffd\\u001a\ufffd]\\u001d\ufffd\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffd*C\ufffd0\ufffd \ufffd\\ry\ufffdq\ufffd\ufffd6\\th)\\f\ufffd\\u0002*\\u0000\ufffd?\ufffd\ufffd\\u0018|\ufffd\ufffd\ufffd\\u001a\ufffd]\\u001d\ufffd\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0001\\u0000\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000*\\u0000(\\t\\u0005\\t\\u0006\\t\\u0004\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\u001a\\b\\u001b\\b\\u001c\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0000+\\u0000\\u0003\\u0002\\u0003\\u0004\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\ufffd6\\u000e\ufffd\ufffdr\ufffd6\ufffda\\u001a\ufffd\ufffd\\u0004l\ufffd\ufffdcCux\ufffd\ufffd\\u0019\ufffd\\u0015\ufffd\ufffdj\\u0019=\\u0016\ufffd3\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffd*C\ufffd0\ufffd \ufffd\\ry\ufffdq\ufffd\ufffd6\\th)\\f\ufffd\\u0002*\\u0000\ufffd?\ufffd\ufffd\\u0018|\ufffd\ufffd\ufffd\\u001a\ufffd]\\u001d\ufffd\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224869c7d836113e5d9ef43a0bbbb4c971fd68fc67\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffd*C\ufffd0\ufffd \ufffd\\ry\ufffdq\ufffd\ufffd6\\th)\\f\ufffd\\u0002*\\u0000\ufffd?\ufffd\ufffd\\u0018|\ufffd\ufffd\ufffd\\u001a\ufffd]\\u001d\ufffd\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022tls_ja3\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffd*C\ufffd0\ufffd \ufffd\\ry\ufffdq\ufffd\ufffd6\\th)\ufffd*\ufffd?\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\\nm\\r\\n62.3.50.33\\n\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (46 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8764, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\\u001c\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffd*C\ufffd0\ufffd \ufffd\\ry\ufffdq\ufffd\ufffd6\\th)\\f\ufffd\\u0002*\\u0000\ufffd?\ufffd\ufffd\\u0018|\ufffd\ufffd\ufffd\\u001a\ufffd]\\u001d\ufffd\ufffd\\u0000\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0013\\u0004\\u0013\\u0005\\u0001\\u0000\\u0005m\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0012\\u0000\\u0010\\u0011\ufffd\\u0000\u0022, \u0022tls_ja3\u0022: \u0022de8c366fbb06bedcd7b86ddda1addac6\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdR=Q\ufffd\u00bc\ufffdg\ufffdv\ufffd\ufffd\ufffd\ufffd\/6\ufffd4\ufffd\ufffd*C\ufffd0\ufffd \ufffd\\ry\ufffdq\ufffd\ufffd6\\th)\ufffd*\ufffd?\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\\nm\\r\\n62.3.50.33\\n\ufffd\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228764\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 13, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023, 9043], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 0.83, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 46, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"de8c366fbb06bedcd7b86ddda1addac6","tls_ja3":"771,4865-4866-4867-4868-4869,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022]","anomalies":"[]","severity":5,"bytes_in":1481},{"id":14907738,"ip":"34.19.127.180","ts":"2026-08-01 09:03:48.000000","proto":"tcp","src_port":45062,"dst_port":9023,"service":"devops-probe","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.861251758815763, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022devops-probe\u0022, \u0022app_proto\u0022: \u0022devops-probe\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9023, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fadef17fbfbe857adbca975016d2c0235abc5bf0\u0022, \u0022event_fingerprint\u0022: \u0022ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002250e2fffb2f39899f91a4b5083b0251f8\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022}, \u0022tls_ja3_hash\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja3\u0022: \u0022770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$\u003C\ufffdo\u073a,5\ufffdl\\u0000\ufffd(X\ufffd\\u001b\ufffd\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$\u003C\ufffdo\u073a,5\ufffdl\\u0000\ufffd(X\ufffd\\u001b\ufffd\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$\u003C\ufffdo\u073a,5\ufffdl\\u0000\ufffd(X\ufffd\\u001b\ufffd\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002246761935e73573c5157fb0650a62e3faa5cc6879\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$\u003C\ufffdo\u073a,5\ufffdl\\u0000\ufffd(X\ufffd\\u001b\ufffd\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$\u003C\ufffdo\u073a,5\ufffdl\ufffd(X\ufffd\ufffd\ufffd\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022dst_port\u0022: 9023, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$\u003C\ufffdo\u073a,5\ufffdl\\u0000\ufffd(X\ufffd\\u001b\ufffd\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ufffd}t$\u003C\ufffdo\u073a,5\ufffdl\ufffd(X\ufffd\ufffd\ufffd\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022devops_probe\u0022, \u0022service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229023\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 12, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.67, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14907745,"ip":"34.19.127.180","ts":"2026-08-01 09:03:48.000000","proto":"tcp","src_port":64076,"dst_port":8880,"service":"http","classification":"port_scan_syn","waf_score":27,"waf_tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/v1\/swagger.json","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226f70656e617069223a22332e30\u0022, \u0022emulator_response_len\u0022: 222, \u0022http_header_count\u0022: 3, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u0022e94391cc8fe1320169499d4960096ce95e356a37\u0022, \u0022http_host_hash\u0022: \u0022c3a8697c6c279a95f0caf2b5f47944b1de8a6733\u0022, \u0022http_target_hash\u0022: \u00227627fa107933323bf661cade27cead0da21efcde\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 219, \u0022payload_entropy\u0022: 5.480135730688123, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8880, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 65, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a7c367cf3eb99fe4c81124788d072f3024ca5a82\u0022, \u0022event_fingerprint\u0022: \u0022e5370e137e9a3e9bd5d018b3220e276f63f58360\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 65, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226bd514d731f202b33c4f6bd8919738b7\u0022, \u0022payload_hash\u0022: \u002200280f465dba4a63a1e2ae5b9cce7f11\u0022, \u0022path_pattern_hash\u0022: \u0022f86aafc3677c18150142bcf664f5a6ed\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 65}, \u0022payload_preview\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (X11; \u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/v1\/swagger.json\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (X11;\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/v1\/swagger.json\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (X11;\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022aed6751ee17d2063e438249c3dad07607299b43b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/v1\/swagger.json\u0022, \u0022request_line\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\u0022, \u0022port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (X11;\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/swagger.json\u0022, \u0022target_port_label\u0022: \u00228880 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 65, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 65, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8880, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/v1\/swagger.json\u0022, \u0022request_line\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36\u0022, \u0022port\u0022: 8880, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/swagger.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/v1\/swagger.json HTTP\/1.1\\r\\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\\r\\nAccept: *\/*\\r\\nUser-Agent: Mozilla\/5.0 (X11;\u0022, \u0022target_port_label\u0022: \u00228880 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +28 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228880\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 12, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.66, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_swagger_probe\u0022, \u0022net_port_scan_slow\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"ip-62-3-50-33.v4.isp.servpersosystems.net:8880","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/100.0.4896.88 Safari\/537.36","http_referer":null,"tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022http_swagger_probe\u0022, \u0022net_port_scan_slow\u0022]","anomalies":"[]","severity":10,"bytes_in":219},{"id":14907758,"ip":"34.19.127.180","ts":"2026-08-01 09:03:48.000000","proto":"tcp","src_port":1302,"dst_port":8764,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 23, \u0022bytes_in\u0022: 175, \u0022payload_entropy\u0022: 4.865666788395714, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8764, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225fcedec66145ae3b327dad80fd3d18700aaf46ca\u0022, \u0022event_fingerprint\u0022: \u0022db826933ae27a2eb10e83c34641a7b84f3456ff4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022payload_hash\u0022: \u00225b44ae70e83d07768a8dd407b7d97513\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022ja3_client_category\u0022: \u0022browser_like\u0022}, \u0022tls_ja3\u0022: \u0022770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_ja4\u0022: \u0022t13d0135_d3a8096b2c3a_482398de1203\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 35, \u0022ja3_client_category\u0022: \u0022browser_like\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\\f4\ufffd(\ufffdZ\\u0002X\u03a9\ufffd\\u001b\ufffdp\ufffd\ufffd\\u0003!|\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\\f4\ufffd(\ufffdZ\\u0002X\u03a9\ufffd\\u001b\ufffdp\ufffd\ufffd\\u0003!|\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.3.50.33\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0018\\u0000\\u0019\\u0000#\\u0000\\u0000\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\\f4\ufffd(\ufffdZ\\u0002X\u03a9\ufffd\\u001b\ufffdp\ufffd\ufffd\\u0003!|\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022005b26ed9daf9734672e0273ef8266c90153647f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\\f4\ufffd(\ufffdZ\\u0002X\u03a9\ufffd\\u001b\ufffdp\ufffd\ufffd\\u0003!|\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF4\ufffd(\ufffdZX\u03a9\ufffd\ufffdp\ufffd\ufffd!|\ufffd\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8764, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0002\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF\\f4\ufffd(\ufffdZ\\u0002X\u03a9\ufffd\\u001b\ufffdp\ufffd\ufffd\\u0003!|\ufffd\ufffd\\u0000\\u0000F\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u00007\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f9b8f0bb9fb9f179320b2833fbe71c48\u0022, \u0022tls_ja4\u0022: \u002262d31e78fdc457d27559991ebb0871be\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffdSF4\ufffd(\ufffdZX\u03a9\ufffd\ufffdp\ufffd\ufffd!|\ufffd\ufffdF\ufffd\\n\ufffd98\ufffd\ufffd\ufffd:\ufffd\ufffd\\t\ufffd32ED\ufffd4F\ufffd\ufffd\ufffd5\ufffd\/A\\n\ufffd\ufffd\ufffd\ufffd7\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228764\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 12, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.64, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"f9b8f0bb9fb9f179320b2833fbe71c48","tls_ja3":"770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-53-132-47-65-10-49158-49168-49173-2-1-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":175},{"id":14907773,"ip":"34.19.127.180","ts":"2026-08-01 09:03:48.000000","proto":"tcp","src_port":45063,"dst_port":9023,"service":"devops-probe","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 899, \u0022payload_entropy\u0022: 5.743058781718342, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022devops-probe\u0022, \u0022app_proto\u0022: \u0022devops-probe\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9023, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fadef17fbfbe857adbca975016d2c0235abc5bf0\u0022, \u0022event_fingerprint\u0022: \u0022ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222c216d6615c900b053ae4d57d1d4ad0a\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u001a\\u0000\\u001b\\u0000\\u001e\\u0000\\u001f\\u0000 \\u0000!\\u0000\\\u0022\\u0000#\\u0000$\\u0000%\\u0000\u0026\\u0000\u0027\\u0000(\\u0000)\\u0000*\\u0000+\\u0000,\\u0000-\\u0000.\\u0000\/\\u00000\\u00001\\u00002\\u00003\\u00004\\u00005\\u00006\\u00007\\u00008\\u00009\\u0000:\\u0000;\\u0000\u003C\\u0000=\\u0000\u003E\\u0000?\\u0000@\\u0000A\\u0000B\\u0000C\\u0000D\\u0000E\\u0000F\\u0000g\\u0000h\\u0000i\\u0000j\\u0000k\\u0000l\\u0000m\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226a985fa29a8dc510ab8384e743798b45f15f45ec\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022dst_port\u0022: 9023, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022devops_probe\u0022, \u0022service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229023\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 12, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.62, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":899},{"id":14907792,"ip":"34.19.127.180","ts":"2026-08-01 09:03:48.000000","proto":"tcp","src_port":61905,"dst_port":8764,"service":"tls","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 102, \u0022bytes_in\u0022: 899, \u0022payload_entropy\u0022: 5.743058781718342, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8764, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225fcedec66145ae3b327dad80fd3d18700aaf46ca\u0022, \u0022event_fingerprint\u0022: \u0022d0fa2f3f0b339111a6c4b4b81018509aebb179b5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022payload_hash\u0022: \u00222c216d6615c900b053ae4d57d1d4ad0a\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u001a\\u0000\\u001b\\u0000\\u001e\\u0000\\u001f\\u0000 \\u0000!\\u0000\\\u0022\\u0000#\\u0000$\\u0000%\\u0000\u0026\\u0000\u0027\\u0000(\\u0000)\\u0000*\\u0000+\\u0000,\\u0000-\\u0000.\\u0000\/\\u00000\\u00001\\u00002\\u00003\\u00004\\u00005\\u00006\\u00007\\u00008\\u00009\\u0000:\\u0000;\\u0000\u003C\\u0000=\\u0000\u003E\\u0000?\\u0000@\\u0000A\\u0000B\\u0000C\\u0000D\\u0000E\\u0000F\\u0000g\\u0000h\\u0000i\\u0000j\\u0000k\\u0000l\\u0000m\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002212f5857b0073f3e743f42b20d4172fb781a2faf8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8764, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0003~\\u0001\\u0000\\u0003z\\u0003\\u0003jm\ufffdu\ufffd\ufffdH\\u000b\ufffd\\u0000\u06e0\\u0013Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\\u0003\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\\u000e\ufffdr\ufffd\ufffdi\ufffdH9\\u0002\ufffd\\u0000\\u0000\\u0000\\u0001\\u0000\\u0002\\u0000\\u0003\\u0000\\u0004\\u0000\\u0005\\u0000\\u0006\\u0000\\u0007\\u0000\\b\\u0000\\t\\u0000\\n\\u0000\\u000b\\u0000\\f\\u0000\\r\\u0000\\u000e\\u0000\\u000f\\u0000\\u0010\\u0000\\u0011\\u0000\\u0012\\u0000\\u0013\\u0000\\u0014\\u0000\\u0015\\u0000\\u0016\\u0000\\u0017\\u0000\\u0018\u0022, \u0022tls_ja3\u0022: \u00224ae33de1ad93956213297c61748ec996\u0022, \u0022tls_sni\u0022: \u002262.3.50.33\u0022, \u0022port\u0022: 8764, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via TLS:8764 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022~zjm\ufffdu\ufffd\ufffdH\ufffd\u06e0Jm6\ufffd\ufffd\ufffd\ufffd\\\u0022\u0751a\ufffd\u0026$\ufffd%p\ufffd\ufffd \ufffd\ufffdH\\\u0022\u003C\u06f7\ufffdLmMW\ufffd\ufffd\ufffd\ufffd\u07d1xf)$\ufffdr\ufffd\ufffdi\ufffdH9\ufffd\u0022, \u0022target_port_label\u0022: \u00228764 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228764\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 12, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.68, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":"62.3.50.33","tls_ja3_hash":"4ae33de1ad93956213297c61748ec996","tls_ja3":"771,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-103-104-105-106-107-108-109-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-4870-4871-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-49332-49333-49408-49409-49410-49411-49412-49413-49414-52392-52393-52394-52395-52396-52397-52398-53249-53250-53251-53253-255,0-11-35-13-10,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_port_scan_slow\u0022, \u0022tls_ja3\u0022, \u0022tls_sni_ip\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":5,"bytes_in":899},{"id":14907810,"ip":"34.19.127.180","ts":"2026-08-01 09:03:48.000000","proto":"tcp","src_port":45064,"dst_port":9023,"service":"devops-probe","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206465766f70735f70726f626520726561647920706f72743d393032330d0a\u0022, \u0022emulator_response_len\u0022: 43, \u0022bytes_in\u0022: 351, \u0022payload_entropy\u0022: 5.381095551885722, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022devops-probe\u0022, \u0022app_proto\u0022: \u0022devops-probe\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9023, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fadef17fbfbe857adbca975016d2c0235abc5bf0\u0022, \u0022event_fingerprint\u0022: \u0022ebfd972b642e1c9f677854bfa5ac9dd2ca4ce15e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00221bf28fc299b035cc8c830442fa877c6e\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd\\b\ufffd\ufffd\\u0017\ufffd)c}\ufffd34\\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd\u003E\\\u0022\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd\\b\ufffd\ufffd\\u0017\ufffd)c}\ufffd34\\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd\u003E\\\u0022\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\\u0000l\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00009\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\u0019\\u0000:\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00003\\u00002\\u0000E\\u0000D\ufffd\\u0018\\u00004\\u0000F\ufffd\\b\ufffd\\u0012\\u0000\\u0016\\u0000\\u0013\ufffd\\u0017\\u0000\\u001b\\u0000\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u00005\\u0000\ufffd\\u0000\/\\u0000A\\u0000\\n\ufffd\\u0006\ufffd\\u0010\ufffd\\u0015\\u0000;\\u0000\\u0002\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000k\\u0000\\u0000\\u0000\\u000f\\u0000\\r\\u0000\\u0000\\n62.\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd\\b\ufffd\ufffd\\u0017\ufffd)c}\ufffd34\\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd\u003E\\\u0022\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002261aeebe7938d8f542fc3267c80668ad4eea8537d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd\\b\ufffd\ufffd\\u0017\ufffd)c}\ufffd34\\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd\u003E\\\u0022\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022evidence_snippet\u0022: \u0022ZV\ufffd\ufffd\ufffd\ufffd\ufffd)c}\ufffd34\\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Sonde DevOps (GitLab\/Portainer\/ArgoCD) \u2014 multi-protocole (45 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 28}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022dst_port\u0022: 9023, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +28\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001Z\\u0001\\u0000\\u0001V\\u0003\\u0003\ufffd\ufffd\\b\ufffd\ufffd\\u0017\ufffd)c}\ufffd34\\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd\u003E\\\u0022\ufffd\\u0011\ufffd\ufffd\\u0000\\u0000\ufffd\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\\u0000\ufffd\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\\u0000m\\u0000\ufffd\ufffd#\ufffd\u0027\u0022, \u0022port\u0022: 9023, \u0022service\u0022: \u0022devops-probe\u0022, \u0022service_label_fr\u0022: \u0022Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via Sonde DevOps (GitLab\/Portainer\/ArgoCD):9023 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022ZV\ufffd\ufffd\ufffd\ufffd\ufffd)c}\ufffd34\\t\ufffd\ufffd\ufffd9U`\ufffd{\ufffdx\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(kj\ufffds\ufffdw\ufffd\ufffdm\ufffd\ufffd#\ufffd\u0027\u0022, \u0022target_port_label\u0022: \u00229023 \u00b7 Sonde DevOps (GitLab\/Portainer\/ArgoCD)\u0022, \u0022emulator_service\u0022: \u0022devops-probe\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.127.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022devops_probe\u0022, \u0022service_banner\u0022: \u0022honeypot-devops-probe\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229023\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 12, \u0022port_scan_ports_sample\u0022: [8104, 8764, 8826, 8842, 8844, 8868, 8880, 8888, 8889, 8908, 9011, 9023], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 0.66, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 45, \u0022multi_protocol_sample\u0022: [\u0022clickhouse-http\u0022, \u0022consul-server\u0022, \u0022devops-probe\u0022, \u0022github-webhook\u0022, \u0022hdfs-namenode\u0022, \u0022http\u0022, \u0022http-alt-8004\u0022, \u0022http-alt-8040\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002234.19.127.0\/24\u0022, \u0022coordinated_ip_count\u0022: 28, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 28, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022devops_probe_emulated\u0022, \u0022net_port_scan_slow\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":351}],"total_events":4153}